]> arthur.barton.de Git - ngircd-alex.git/blobdiff - src/ngircd/irc.c
Fix use-after-free while handling ERROR during client login
[ngircd-alex.git] / src / ngircd / irc.c
index ee7972c215a7534519cea8759d4252341e80ef37..eae046d3eab11703c00fd695307abce7ede115d2 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * ngIRCd -- The Next Generation IRC Daemon
- * Copyright (c)2001-2013 Alexander Barton (alex@barton.de) and Contributors.
+ * Copyright (c)2001-2018 Alexander Barton (alex@barton.de) and Contributors.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * IRC commands
  */
 
-#include "imp.h"
 #include <assert.h>
 #include <stdio.h>
 #include <string.h>
+#include <strings.h>
+#include <time.h>
 
 #include "ngircd.h"
 #include "conn-func.h"
 #include "conf.h"
 #include "channel.h"
-#include "conn-encoding.h"
-#include "defines.h"
+#ifdef ICONV
+# include "conn-encoding.h"
+#endif
 #include "irc-macros.h"
 #include "irc-write.h"
 #include "log.h"
@@ -34,9 +36,7 @@
 #include "messages.h"
 #include "parse.h"
 #include "op.h"
-#include "tool.h"
 
-#include "exp.h"
 #include "irc.h"
 
 static char *Option_String PARAMS((CONN_ID Idx));
@@ -85,6 +85,8 @@ IRC_CheckListTooBig(CLIENT *From, const int Count, const int Limit,
 GLOBAL bool
 IRC_ERROR(CLIENT *Client, REQUEST *Req)
 {
+       char *msg;
+
        assert( Client != NULL );
        assert( Req != NULL );
 
@@ -99,12 +101,20 @@ IRC_ERROR(CLIENT *Client, REQUEST *Req)
                return CONNECTED;
        }
 
-       if (Req->argc < 1)
+       if (Req->argc < 1) {
+               msg = "Got ERROR command";
                Log(LOG_NOTICE, "Got ERROR from \"%s\"!",
                    Client_Mask(Client));
-       else
+       } else {
+               msg = Req->argv[0];
                Log(LOG_NOTICE, "Got ERROR from \"%s\": \"%s\"!",
-                   Client_Mask(Client), Req->argv[0]);
+                   Client_Mask(Client), msg);
+       }
+
+       if (Client_Conn(Client) != NONE) {
+               Conn_Close(Client_Conn(Client), NULL, msg, false);
+               return DISCONNECTED;
+       }
 
        return CONNECTED;
 } /* IRC_ERROR */
@@ -224,8 +234,6 @@ IRC_TRACE(CLIENT *Client, REQUEST *Req)
        assert(Client != NULL);
        assert(Req != NULL);
 
-       IRC_SetPenalty(Client, 3);
-
        _IRC_GET_SENDER_OR_RETURN_(from, Req, Client)
        _IRC_GET_TARGET_SERVER_OR_RETURN_(target, Req, 0, from)
 
@@ -242,7 +250,7 @@ IRC_TRACE(CLIENT *Client, REQUEST *Req)
                                        PACKAGE_VERSION, Client_ID(target),
                                        Client_ID(Client_NextHop(target)),
                                        Option_String(idx2),
-                                       time(NULL) - Conn_StartTime(idx2),
+                                       (long)(time(NULL) - Conn_StartTime(idx2)),
                                        Conn_SendQ(idx), Conn_SendQ(idx2)))
                        return DISCONNECTED;
 
@@ -301,8 +309,6 @@ IRC_HELP(CLIENT *Client, REQUEST *Req)
        assert(Client != NULL);
        assert(Req != NULL);
 
-       IRC_SetPenalty(Client, 2);
-
        if ((Req->argc == 0 && array_bytes(&Conf_Helptext) > 0)
            || (Req->argc >= 1 && strcasecmp(Req->argv[0], "Commands") != 0)) {
                /* Help text available and requested */
@@ -343,9 +349,12 @@ GLOBAL bool
 IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reason)
 {
        const char *msg;
-       CONN_ID my_conn, conn;
+       CONN_ID my_conn = NONE, conn;
        CLIENT *c;
 
+       assert(Nick != NULL);
+       assert(Reason != NULL);
+
        /* Do we know such a client in the network? */
        c = Client_Search(Nick);
        if (!c) {
@@ -353,12 +362,8 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
                return CONNECTED;
        }
 
-       /* Inform other servers */
-       IRC_WriteStrServersPrefix(From ? Client : NULL,
-                                 From ? From : Client_ThisServer(),
-                                 "KILL %s :%s", Nick, Reason);
-
-       if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK) {
+       if (Client_Type(c) != CLIENT_USER && Client_Type(c) != CLIENT_GOTNICK
+           && Client_Type(c) != CLIENT_SERVICE) {
                /* Target of this KILL is not a regular user, this is
                 * invalid! So we ignore this case if we received a
                 * regular KILL from the network and try to kill the
@@ -379,8 +384,15 @@ IRC_KillClient(CLIENT *Client, CLIENT *From, const char *Nick, const char *Reaso
                    Client_Type(c), Nick);
        }
 
+       /* Inform other servers */
+       IRC_WriteStrServersPrefix(From ? Client : NULL,
+                                 From ? From : Client_ThisServer(),
+                                 "KILL %s :%s", Nick, Reason);
+
+
        /* Save ID of this connection */
-       my_conn = Client_Conn(Client);
+       if (Client)
+               my_conn = Client_Conn(Client);
 
        /* Kill the client NOW:
         *  - Close the local connection (if there is one),
@@ -471,16 +483,11 @@ Help(CLIENT *Client, const char *Topic)
  * @return Pointer to static (global) string buffer.
  */
 static char *
-#ifdef ZLIB
+#if defined(SSL_SUPPORT) || defined(ZLIB)
 Option_String(CONN_ID Idx)
-#else
-Option_String(UNUSED CONN_ID Idx)
-#endif
 {
        static char option_txt[8];
-#ifdef ZLIB
        UINT16 options;
-#endif
 
        assert(Idx != NONE);
 
@@ -495,11 +502,27 @@ Option_String(UNUSED CONN_ID Idx)
        if(options & CONN_ZIP)          /* zlib compression enabled */
                strlcat(option_txt, "z", sizeof(option_txt));
 #endif
-       LogDebug(" *** %d: %d = %s", Idx, options, option_txt);
 
        return option_txt;
+#else
+Option_String(UNUSED CONN_ID Idx)
+{
+       return "";
+#endif
 } /* Option_String */
 
+/**
+ * Send a message to target(s).
+ *
+ * This function is used by IRC_{PRIVMSG|NOTICE|SQUERY} to actualy
+ * send the message(s).
+ *
+ * @param Client The client from which this command has been received.
+ * @param Req Request structure with prefix and all parameters.
+ * @param ForceType Required type of the destination of the message(s).
+ * @param SendErrors Whether to report errors back to the client or not.
+ * @return CONNECTED or DISCONNECTED.
+ */
 static bool
 Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 {
@@ -507,8 +530,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
        CL2CHAN *cl2chan;
        CHANNEL *chan;
        char *currentTarget = Req->argv[0];
-       char *lastCurrentTarget = NULL;
+       char *strtok_last = NULL;
        char *message = NULL;
+       char *targets[MAX_HNDL_TARGETS];
+       int i, target_nr = 0;
 
        assert(Client != NULL);
        assert(Req != NULL);
@@ -528,12 +553,11 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
        if (Req->argc > 2) {
                if (!SendErrors)
                        return CONNECTED;
-               IRC_SetPenalty(Client, 2);
                return IRC_WriteErrClient(Client, ERR_NEEDMOREPARAMS_MSG,
                                          Client_ID(Client), Req->command);
        }
 
-       if (Client_Type(Client) == CLIENT_SERVER)
+       if (Client_Type(Client) == CLIENT_SERVER && Req->prefix)
                from = Client_Search(Req->prefix);
        else
                from = Client;
@@ -549,10 +573,19 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                message = Req->argv[1];
 
        /* handle msgtarget = msgto *("," msgto) */
-       currentTarget = strtok_r(currentTarget, ",", &lastCurrentTarget);
+       currentTarget = strtok_r(currentTarget, ",", &strtok_last);
        ngt_UpperStr(Req->command);
 
+       /* Please note that "currentTarget" is NULL when the target contains
+        * the separator character only, e. g. "," or ",,,," etc.! */
        while (currentTarget) {
+               /* Make sure that there hasn't been such a target already: */
+               targets[target_nr++] = currentTarget;
+               for(i = 0; i < target_nr - 1; i++) {
+                       if (strcasecmp(currentTarget, targets[i]) == 0)
+                               goto send_next_target;
+               }
+
                /* Check for and handle valid <msgto> of form:
                 * RFC 2812 2.3.1:
                 *   msgto =  channel / ( user [ "%" host ] "@" servername )
@@ -661,7 +694,10 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                                goto send_next_target;
                        }
 
-                       if (Client_HasMode(cl, 'C')) {
+                       if (Client_HasMode(cl, 'C') &&
+                           !Client_HasMode(from, 'o') &&
+                           !(Client_Type(from) == CLIENT_SERVER) &&
+                           !(Client_Type(from) == CLIENT_SERVICE)) {
                                cl2chan = Channel_FirstChannelOf(cl);
                                while (cl2chan) {
                                        chan = Channel_GetChannel(cl2chan);
@@ -696,14 +732,14 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                                return DISCONNECTED;
                } else if (ForceType != CLIENT_SERVICE
                           && (chan = Channel_Search(currentTarget))) {
+                       /* Target is a channel */
                        if (!Channel_Write(chan, from, Client, Req->command,
                                           SendErrors, message))
                                        return DISCONNECTED;
                } else if (ForceType != CLIENT_SERVICE
-                       /* $#: server/target mask, RFC 2812, sec. 3.3.1 */
                           && strchr("$#", currentTarget[0])
                           && strchr(currentTarget, '.')) {
-                       /* targetmask */
+                       /* $#: server/host mask, RFC 2812, sec. 3.3.1 */
                        if (!Send_Message_Mask(from, Req->command, currentTarget,
                                               message, SendErrors))
                                return DISCONNECTED;
@@ -716,14 +752,35 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                }
 
        send_next_target:
-               currentTarget = strtok_r(NULL, ",", &lastCurrentTarget);
-               if (currentTarget)
-                       Conn_SetPenalty(Client_Conn(Client), 1);
+               currentTarget = strtok_r(NULL, ",", &strtok_last);
+               if (!currentTarget)
+                       break;
+
+               Conn_SetPenalty(Client_Conn(Client), 1);
+
+               if (target_nr >= MAX_HNDL_TARGETS) {
+                       /* Too many targets given! */
+                       return IRC_WriteErrClient(Client,
+                                                 ERR_TOOMANYTARGETS_MSG,
+                                                 currentTarget);
+               }
        }
 
        return CONNECTED;
 } /* Send_Message */
 
+/**
+ * Send a message to "target mask" target(s).
+ *
+ * See RFC 2812, sec. 3.3.1 for details.
+ *
+ * @param from The client from which this command has been received.
+ * @param command The command to use (PRIVMSG, NOTICE, ...).
+ * @param targetMask The "target mask" (will be verified by this function).
+ * @param message The message to send.
+ * @param SendErrors Whether to report errors back to the client or not.
+ * @return CONNECTED or DISCONNECTED.
+ */
 static bool
 Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
                  char * message, bool SendErrors)
@@ -747,17 +804,15 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
         * dot (".") and no wildcards ("*", "?") following the last one.
         */
        check_wildcards = strrchr(targetMask, '.');
-       assert(check_wildcards != NULL);
-       if (check_wildcards &&
-               check_wildcards[strcspn(check_wildcards, "*?")])
-       {
+       if (!check_wildcards || check_wildcards[strcspn(check_wildcards, "*?")]) {
                if (!SendErrors)
                        return true;
-               return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL, targetMask);
+               return IRC_WriteErrClient(from, ERR_WILDTOPLEVEL_MSG,
+                                         targetMask);
        }
 
-       /* #: hostmask, see RFC 2812, sec. 3.3.1 */
        if (targetMask[0] == '#') {
+               /* #: hostmask, see RFC 2812, sec. 3.3.1 */
                for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
                        if (Client_Type(cl) != CLIENT_USER)
                                continue;
@@ -768,7 +823,8 @@ Send_Message_Mask(CLIENT * from, char * command, char * targetMask,
                                        return false;
                }
        } else {
-               assert(targetMask[0] == '$'); /* $: server mask, see RFC 2812, sec. 3.3.1 */
+               /* $: server mask, see RFC 2812, sec. 3.3.1 */
+               assert(targetMask[0] == '$');
                for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
                        if (Client_Type(cl) != CLIENT_USER)
                                continue;