SECURITY: Fixed a message handling bug which could crash the daemon.

[ngircd-alex.git] / src / ngircd / irc-channel.c

diff --git a/src/ngircd/irc-channel.c b/src/ngircd/irc-channel.c
index c678ceeb3f4160a933c6e845ed427e45c7aff70c..f64570ad6483924c8a72fd08ac8b74088ebf31e7 100644 (file)
--- a/src/ngircd/irc-channel.c
+++ b/src/ngircd/irc-channel.c
@@ -26,6 +26,7 @@ static char UNUSED id[] = "$Id: irc-channel.c,v 1.45 2008/02/24 18:57:38 fw Exp
 #include "conn.h"
 #include "client.h"
 #include "channel.h"
+#include "conn-func.h"
 #include "lists.h"
 #include "log.h"
 #include "match.h"
@@ -70,6 +71,10 @@ join_allowed(CLIENT *Client, CLIENT *target, CHANNEL *chan,
        bool is_invited, is_banned;
        const char *channel_modes;
 
+       /* Allow IRC operators to overwrite channel limits */
+       if (strchr(Client_Modes(Client), 'o'))
+               return true;
+
        is_banned = Lists_Check(Channel_GetListBans(chan), target);
        is_invited = Lists_Check(Channel_GetListInvites(chan), target);
 
@@ -177,7 +182,7 @@ join_send_topic(CLIENT *Client, CLIENT *target, CHANNEL *chan,
 GLOBAL bool
 IRC_JOIN( CLIENT *Client, REQUEST *Req )
 {
-       char *channame, *channame_ptr, *key, *key_ptr, *flags;
+       char *channame, *key = NULL, *flags, *lastkey = NULL, *lastchan = NULL;
        CLIENT *target;
        CHANNEL *chan;
 
@@ -203,16 +208,16 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                return part_from_all_channels(Client, target);
 
        /* Are channel keys given? */
-       if (Req->argc > 1) {
-               key = Req->argv[1];
-               key_ptr = strchr(key, ',');
-               if (key_ptr) *key_ptr = '\0';
-       } else {
-               key = key_ptr = NULL;
-       }
+       if (Req->argc > 1)
+               key = strtok_r(Req->argv[1], ",", &lastkey);
+
        channame = Req->argv[0];
-       channame_ptr = strchr(channame, ',');
-       if (channame_ptr) *channame_ptr = '\0';
+       channame = strtok_r(channame, ",", &lastchan);
+
+       /* Make sure that "channame" is not the empty string ("JOIN :") */
+       if (! channame)
+               return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG,
+                                         Client_ID(Client), Req->command);
 
        while (channame) {
                flags = NULL;
@@ -239,11 +244,19 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                        if ((Conf_MaxJoins > 0) && (Channel_CountForUser(Client) >= Conf_MaxJoins))
                                return IRC_WriteStrClient(Client, ERR_TOOMANYCHANNELS_MSG,
                                                        Client_ID(Client), channame);
-                       if (!chan) /* New Channel: first user will be channel operator */
-                               flags = "o";
-                       else
+                       if (!chan) {
+                               /*
+                                * New Channel: first user will be channel operator
+                                * unless this is a modeless channel.
+                                */
+                               if (*channame != '+')
+                                       flags = "o";
+                       } else
                                if (!join_allowed(Client, target, chan, channame, key))
                                        break;
+
+                       /* Local client: update idle time */
+                       Conn_UpdateIdle(Client_Conn(Client));
                } else {
                        /* Remote server: we don't need to know whether the
                         * client is invited or not, but we have to make sure
@@ -257,8 +270,14 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                if (!Channel_Join(target, channame))
                        break;
 
-               if (!chan) /* channel is new; it has been created above */
+               if (!chan) { /* channel is new; it has been created above */
                        chan = Channel_Search(channame);
+                       assert(chan != NULL);
+                       if (*channame == '+') { /* modeless channel... */
+                               Channel_ModeAdd(chan, 't'); /* /TOPIC not allowed */
+                               Channel_ModeAdd(chan, 'n'); /* no external msgs */
+                       }
+               }
                assert(chan != NULL);
 
                join_set_channelmodes(chan, target, flags);
@@ -269,18 +288,9 @@ IRC_JOIN( CLIENT *Client, REQUEST *Req )
                        break; /* write error */
 
                /* next channel? */
-               channame = channame_ptr;
-               if (channame) {
-                       channame++;
-                       channame_ptr = strchr(channame, ',');
-                       if (channame_ptr) *channame_ptr = '\0';
-
-                       if (key_ptr) {
-                               key = ++key_ptr;
-                               key_ptr = strchr(key, ',');
-                               if (key_ptr) *key_ptr = '\0';
-                       }
-               }
+               channame = strtok_r(NULL, ",", &lastchan);
+               if (channame && key)
+                       key = strtok_r(NULL, ",", &lastkey);
        }
        return CONNECTED;
 } /* IRC_JOIN */
@@ -313,11 +323,22 @@ IRC_PART(CLIENT * Client, REQUEST * Req)
 
        /* Loop over all the given channel names */
        chan = strtok(Req->argv[0], ",");
+
+       /* Make sure that "chan" is not the empty string ("PART :") */
+       if (! chan)
+               return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG,
+                                         Client_ID(Client), Req->command);
+
        while (chan) {
                Channel_Part(target, Client, chan,
                             Req->argc > 1 ? Req->argv[1] : Client_ID(target));
                chan = strtok(NULL, ",");
        }
+
+       /* Update idle time, if local client */
+       if (Client_Conn(Client) > NONE)
+               Conn_UpdateIdle(Client_Conn(Client));
+
        return CONNECTED;
 } /* IRC_PART */
 
@@ -333,8 +354,8 @@ IRC_TOPIC( CLIENT *Client, REQUEST *Req )
        assert( Client != NULL );
        assert( Req != NULL );
 
-       /* Falsche Anzahl Parameter? */
-       if(( Req->argc < 1 ) || ( Req->argc > 2 )) return IRC_WriteStrClient( Client, ERR_NEEDMOREPARAMS_MSG, Client_ID( Client ), Req->command );
+       if ((Req->argc < 1) || (Req->argc > 2))
+               return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG, Client_ID(Client), Req->command);
 
        if( Client_Type( Client ) == CLIENT_SERVER ) from = Client_Search( Req->prefix );
        else from = Client;