SECURITY: Fixed a message handling bug which could crash the daemon.

Some message targets could lead to a NULL pointer dereference and therefore
could crash the daemon (denial of service).
(cherry picked from commit e493ad2d30ff80bca2556cde2212e367cb006517)

diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c
index c49a77a4fcf13444afeaf8b79119eec7709416e6..77cc7c1ea2c1196ba86d8e142d18b174e60351cd 100644 (file)
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -397,7 +397,7 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
                        for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
                                if (Client_Type(cl) != CLIENT_USER)
                                        continue;
-                               if (nick != NULL) {
+                               if (nick != NULL && host != NULL) {
                                        if (strcmp(nick, Client_ID(cl)) == 0 &&
                                            strcmp(user, Client_User(cl)) == 0 &&
                                            strcasecmp(host, Client_Hostname(cl)) == 0)