Fix use-after-free while handling ERROR during client login

[ngircd-alex.git] / src / ngircd / irc.c

diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c
index 7acd84ee7857fa0a9a3b5e7af54b9384c9547f0f..eae046d3eab11703c00fd695307abce7ede115d2 100644 (file)
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -112,7 +112,7 @@ IRC_ERROR(CLIENT *Client, REQUEST *Req)
        }
 
        if (Client_Conn(Client) != NONE) {
-               Client_Destroy(Client, NULL, msg, false);
+               Conn_Close(Client_Conn(Client), NULL, msg, false);
                return DISCONNECTED;
        }
 
@@ -483,11 +483,8 @@ Help(CLIENT *Client, const char *Topic)
  * @return Pointer to static (global) string buffer.
  */
 static char *
-#ifdef ZLIB
+#if defined(SSL_SUPPORT) || defined(ZLIB)
 Option_String(CONN_ID Idx)
-#else
-Option_String(UNUSED CONN_ID Idx)
-#endif
 {
        static char option_txt[8];
        UINT16 options;
@@ -507,6 +504,11 @@ Option_String(UNUSED CONN_ID Idx)
 #endif
 
        return option_txt;
+#else
+Option_String(UNUSED CONN_ID Idx)
+{
+       return "";
+#endif
 } /* Option_String */
 
 /**
@@ -692,7 +694,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                                goto send_next_target;
                        }
 
-                       if (Client_HasMode(cl, 'C')) {
+                       if (Client_HasMode(cl, 'C') &&
+                           !Client_HasMode(from, 'o') &&
+                           !(Client_Type(from) == CLIENT_SERVER) &&
+                           !(Client_Type(from) == CLIENT_SERVICE)) {
                                cl2chan = Channel_FirstChannelOf(cl);
                                while (cl2chan) {
                                        chan = Channel_GetChannel(cl2chan);