zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-21 17:42:49 +02:00
Code Issues Projects Releases Packages Wiki Activity

Prevent a UAF error during the execution of some commands

Browse source 
Some arguments were free'd first and then printed, leading to gibberish
being output to screen or a crash.

Found by Joseph Bisch.
Closes: !GL17
This commit is contained in:
LemonBoy 2017-11-11 12:37:51 +01:00
commit 7605f67f95
3 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/fe-common/core/fe-channels.c
View file

@ -278,9 +278,9 @@ static void cmd_channel_add_modify(const char *data, gboolean add)
rec = channel_setup_find(channel, chatnet); rec = channel_setup_find(channel, chatnet);
if (rec == NULL) { if (rec == NULL) {
if (add == FALSE) { if (add == FALSE) {
cmd_params_free(free_arg);
printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE, printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE,
TXT_CHANSETUP_NOT_FOUND, channel, chatnet); TXT_CHANSETUP_NOT_FOUND, channel, chatnet);
cmd_params_free(free_arg);
return; return;
} }

2
src/fe-common/core/fe-server.c
View file

@ -136,9 +136,9 @@ static void cmd_server_add_modify(const char *data, gboolean add)
if (rec == NULL) { if (rec == NULL) {
if (add == FALSE) { if (add == FALSE) {
cmd_params_free(free_arg);
printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE, printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE,
TXT_SETUPSERVER_NOT_FOUND, addr, port); TXT_SETUPSERVER_NOT_FOUND, addr, port);
cmd_params_free(free_arg);
return; return;
} }

2
src/fe-common/irc/fe-ircnet.c
View file

@ -106,9 +106,9 @@ static void cmd_network_add_modify(const char *data, gboolean add)
rec = ircnet_find(name); rec = ircnet_find(name);
if (rec == NULL) { if (rec == NULL) {
if (add == FALSE) { if (add == FALSE) {
cmd_params_free(free_arg);
printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE, printformat(NULL, NULL, MSGLEVEL_CLIENTNOTICE,
IRCTXT_NETWORK_NOT_FOUND, name); IRCTXT_NETWORK_NOT_FOUND, name);
cmd_params_free(free_arg);
return; return;
} }