From b61f54658832d772efa26200abfc0fe6304a39af Mon Sep 17 00:00:00 2001 From: moirhira Date: Mon, 27 Apr 2026 16:00:50 +0100 Subject: [PATCH] fe-dcc-chat: fix segfault in dcc_closed() when window already destroyed During shutdown, query_destroy() fires before dcc_close(), leaving the DCC record pointing at a freed window. dcc_closed() then calls printformat() with NULL as the window item, which causes a NULL dereference in store_lineinfo_tmp() at textbuffer-formats.c:148. Fix by looking up the query window and passing its name string to printformat(), falling back to NULL which safely prints to the server window. Also removes dead code where sender was allocated but never used in the printformat call. Reproducer: /dcc chat , then /quit Tested against both a local server and irc.libera.chat. --- src/fe-common/irc/dcc/fe-dcc-chat.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/fe-common/irc/dcc/fe-dcc-chat.c b/src/fe-common/irc/dcc/fe-dcc-chat.c index 4099e2f1..9edf0d0b 100644 --- a/src/fe-common/irc/dcc/fe-dcc-chat.c +++ b/src/fe-common/irc/dcc/fe-dcc-chat.c @@ -74,14 +74,19 @@ static void dcc_connected(CHAT_DCC_REC *dcc) static void dcc_closed(CHAT_DCC_REC *dcc) { + QUERY_REC *query; char *sender; - if (!IS_DCC_CHAT(dcc)) return; + if (!IS_DCC_CHAT(dcc)) return; + sender = g_strconcat("=", dcc->id, NULL); - printformat(dcc->server, NULL, MSGLEVEL_DCC, - IRCTXT_DCC_CHAT_DISCONNECTED, dcc->id); + query = query_find((SERVER_REC *)dcc->server, sender); g_free(sender); + + + printformat(dcc->server, query ? query->name : NULL, MSGLEVEL_DCC, + IRCTXT_DCC_CHAT_DISCONNECTED, dcc->id); } static void dcc_chat_msg(CHAT_DCC_REC *dcc, const char *msg)