From 294fa3d83ff55f5fbed4614a6f43411c82a1a7ae Mon Sep 17 00:00:00 2001 From: Acts1631 Date: Mon, 6 Jul 2026 10:48:12 -0400 Subject: [PATCH] irc-proxy: guard NULL chatnet in CTCP forwarding In sig_server_event(), when an incoming CTCP PRIVMSG is forwarded to a proxy client that has CTCP forwarding enabled (want_ctcp == 1), the code calls strstr(rec->proxy_address, server->connrec->chatnet). If the victim is connected to a server without a chatnet (connrec->chatnet == NULL, e.g. connected via /server without a network definition), strstr() dereferences the NULL second argument and crashes irssi (SIGSEGV). A remote IRC user triggers this simply by sending a CTCP PRIVMSG to such a victim. connrec->chatnet is nullable throughout irssi (guarded with == NULL in fe-notifylist, fe-server, chatnets, channels) and the sibling handler event_connected() in this same file already guards it with 'chatnet != NULL &&' at the equivalent strstr() call. This path was simply missing the same guard. --- src/irc/proxy/listen.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/irc/proxy/listen.c b/src/irc/proxy/listen.c index 1fed639e..48f6f5a8 100644 --- a/src/irc/proxy/listen.c +++ b/src/irc/proxy/listen.c @@ -539,7 +539,8 @@ static void sig_server_event(IRC_SERVER_REC *server, const char *line, if (rec->want_ctcp == 1) { /* only CTCP for the chatnet where client is connected to will be forwarded */ - if (strstr(rec->proxy_address, server->connrec->chatnet) != NULL) { + if (server->connrec->chatnet != NULL && + strstr(rec->proxy_address, server->connrec->chatnet) != NULL) { net_sendbuffer_send(rec->handle, next_line->str, next_line->len); signal_stop();