From 49ace3251b79a9e97c6e4d0bc640f9143dc71b90 Mon Sep 17 00:00:00 2001 From: ailin-nemui Date: Sun, 8 Oct 2017 19:47:50 +0200 Subject: [PATCH] fix uaf in chanquery module the chanquery needs to be removed in any case if a channel rec is destroyed, regardless of any state Fixes GL#13 --- src/irc/core/channels-query.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/irc/core/channels-query.c b/src/irc/core/channels-query.c index 857ebaf0..d161aec1 100644 --- a/src/irc/core/channels-query.c +++ b/src/irc/core/channels-query.c @@ -125,15 +125,15 @@ static void query_remove_all(IRC_CHANNEL_REC *channel) rec->queries[n] = g_slist_remove(rec->queries[n], channel); rec->current_queries = g_slist_remove(rec->current_queries, channel); - query_check(channel->server); + if (!channel->server->disconnected) + query_check(channel->server); } static void sig_channel_destroyed(IRC_CHANNEL_REC *channel) { g_return_if_fail(channel != NULL); - if (IS_IRC_CHANNEL(channel) && !channel->server->disconnected && - !channel->synced) + if (IS_IRC_CHANNEL(channel)) query_remove_all(channel); }