Fix use-after-free while handling ERROR during client login

[ngircd-alex.git] / src / ngircd / irc.c

diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c
index dc3b2f2ecf120a4147074cae869f5406d6c9fb98..eae046d3eab11703c00fd695307abce7ede115d2 100644 (file)
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2015 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -112,7 +112,7 @@ IRC_ERROR(CLIENT *Client, REQUEST *Req)
        }
 
        if (Client_Conn(Client) != NONE) {
-               Client_Destroy(Client, NULL, msg, false);
+               Conn_Close(Client_Conn(Client), NULL, msg, false);
                return DISCONNECTED;
        }
 
@@ -694,7 +694,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                                goto send_next_target;
                        }
 
-                       if (Client_HasMode(cl, 'C')) {
+                       if (Client_HasMode(cl, 'C') &&
+                           !Client_HasMode(from, 'o') &&
+                           !(Client_Type(from) == CLIENT_SERVER) &&
+                           !(Client_Type(from) == CLIENT_SERVICE)) {
                                cl2chan = Channel_FirstChannelOf(cl);
                                while (cl2chan) {
                                        chan = Channel_GetChannel(cl2chan);