SECURITY: Fixed a message handling bug which could crash the daemon.

[ngircd-alex.git] / src / ngircd / irc-channel.c

diff --git a/src/ngircd/irc-channel.c b/src/ngircd/irc-channel.c
index 92dd8cd37559908da502f289cdee024b65cfe97b..f64570ad6483924c8a72fd08ac8b74088ebf31e7 100644 (file)
--- a/src/ngircd/irc-channel.c
+++ b/src/ngircd/irc-channel.c
@@ -182,7 +182,7 @@ join_send_topic(CLIENT *Client, CLIENT *target, CHANNEL *chan,
 GLOBAL bool
 IRC_JOIN( CLIENT *Client, REQUEST *Req )
 {
-       char *channame, *channame_ptr, *key, *key_ptr, *flags;
+       char *channame, *key = NULL, *flags, *lastkey = NULL, *lastchan = NULL;
        CLIENT *target;
        CHANNEL *chan;
 
@@ -208,16 +208,16 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                return part_from_all_channels(Client, target);
 
        /* Are channel keys given? */
-       if (Req->argc > 1) {
-               key = Req->argv[1];
-               key_ptr = strchr(key, ',');
-               if (key_ptr) *key_ptr = '\0';
-       } else {
-               key = key_ptr = NULL;
-       }
+       if (Req->argc > 1)
+               key = strtok_r(Req->argv[1], ",", &lastkey);
+
        channame = Req->argv[0];
-       channame_ptr = strchr(channame, ',');
-       if (channame_ptr) *channame_ptr = '\0';
+       channame = strtok_r(channame, ",", &lastchan);
+
+       /* Make sure that "channame" is not the empty string ("JOIN :") */
+       if (! channame)
+               return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG,
+                                         Client_ID(Client), Req->command);
 
        while (channame) {
                flags = NULL;
@@ -288,18 +288,9 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                        break; /* write error */
 
                /* next channel? */
-               channame = channame_ptr;
-               if (channame) {
-                       channame++;
-                       channame_ptr = strchr(channame, ',');
-                       if (channame_ptr) *channame_ptr = '\0';
-
-                       if (key_ptr) {
-                               key = ++key_ptr;
-                               key_ptr = strchr(key, ',');
-                               if (key_ptr) *key_ptr = '\0';
-                       }
-               }
+               channame = strtok_r(NULL, ",", &lastchan);
+               if (channame && key)
+                       key = strtok_r(NULL, ",", &lastkey);
        }
        return CONNECTED;
 } /* IRC_JOIN */
@@ -332,6 +323,12 @@ IRC_PART(CLIENT * Client, REQUEST * Req)
 
        /* Loop over all the given channel names */
        chan = strtok(Req->argv[0], ",");
+
+       /* Make sure that "chan" is not the empty string ("PART :") */
+       if (! chan)
+               return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG,
+                                         Client_ID(Client), Req->command);
+
        while (chan) {
                Channel_Part(target, Client, chan,
                             Req->argc > 1 ? Req->argv[1] : Client_ID(target));