zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-09 11:50:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

irc-proxy: guard NULL chatnet in CTCP forwarding

Browse source 
In sig_server_event(), when an incoming CTCP PRIVMSG is forwarded to a
proxy client that has CTCP forwarding enabled (want_ctcp == 1), the code
calls strstr(rec->proxy_address, server->connrec->chatnet). If the
victim is connected to a server without a chatnet (connrec->chatnet ==
NULL, e.g. connected via /server without a network definition),
strstr() dereferences the NULL second argument and crashes irssi
(SIGSEGV). A remote IRC user triggers this simply by sending a CTCP
PRIVMSG to such a victim.

connrec->chatnet is nullable throughout irssi (guarded with == NULL in
fe-notifylist, fe-server, chatnets, channels) and the sibling handler
event_connected() in this same file already guards it with
'chatnet != NULL &&' at the equivalent strstr() call. This path was
simply missing the same guard.
This commit is contained in:
Acts1631 2026-07-06 10:48:12 -04:00
commit 294fa3d83f
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/irc/proxy/listen.c
View file

@ -539,7 +539,8 @@ static void sig_server_event(IRC_SERVER_REC *server, const char *line,
if (rec->want_ctcp == 1) {
/* only CTCP for the chatnet where client is connected to will be forwarded */
if (strstr(rec->proxy_address, server->connrec->chatnet) != NULL) {
if (server->connrec->chatnet != NULL &&
strstr(rec->proxy_address, server->connrec->chatnet) != NULL) {
net_sendbuffer_send(rec->handle,
next_line->str, next_line->len);
signal_stop();