zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-08 19:30:15 +02:00
Code Issues Projects Releases Packages Wiki Activity

fe-dcc-chat: fix segfault in dcc_closed() when window already destroyed

Browse source 
During shutdown, query_destroy() fires before dcc_close(), leaving
the DCC record pointing at a freed window. dcc_closed() then calls
printformat() with NULL as the window item, which causes a NULL
dereference in store_lineinfo_tmp() at textbuffer-formats.c:148.

Fix by looking up the query window and passing its name string
to printformat(), falling back to NULL which safely prints to
the server window. Also removes dead code where sender was
allocated but never used in the printformat call.

Reproducer: /dcc chat <nick>, then /quit
Tested against both a local server and irc.libera.chat.
This commit is contained in:
moirhira 2026-04-27 16:00:50 +01:00
commit b61f546588
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/fe-common/irc/dcc/fe-dcc-chat.c
View file

@ -74,14 +74,19 @@ static void dcc_connected(CHAT_DCC_REC *dcc)
static void dcc_closed(CHAT_DCC_REC *dcc)
{
QUERY_REC *query;
char *sender;
if (!IS_DCC_CHAT(dcc)) return;
if (!IS_DCC_CHAT(dcc)) return;
sender = g_strconcat("=", dcc->id, NULL);
printformat(dcc->server, NULL, MSGLEVEL_DCC,
IRCTXT_DCC_CHAT_DISCONNECTED, dcc->id);
query = query_find((SERVER_REC *)dcc->server, sender);
g_free(sender);
printformat(dcc->server, query ? query->name : NULL, MSGLEVEL_DCC,
IRCTXT_DCC_CHAT_DISCONNECTED, dcc->id);
}
static void dcc_chat_msg(CHAT_DCC_REC *dcc, const char *msg)