Merge branch 'master' into 'security'

Sync to master

See merge request !6

6 files changed, 241 insertions, 74 deletions

diff --git a/src/fe-common/core/fe-ignore.c b/src/fe-common/core/fe-ignore.c
index 52b11e6b..800e881d 100644
--- a/src/fe-common/core/fe-ignore.c
+++ b/src/fe-common/core/fe-ignore.c
@@ -58,7 +58,10 @@ static void ignore_print(int index, IGNORE_REC *rec)
 		g_string_append(options, "-regexp ");
 		if (rec->pattern == NULL)
 			g_string_append(options, "[INVALID! -pattern missing] ");
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+		else if (rec->preg == NULL)
+			g_string_append(options, "[INVALID!] ");
+#else
 		else if (!rec->regexp_compiled)
 			g_string_append(options, "[INVALID!] ");
 #endif
diff --git a/src/fe-common/core/fe-windows.c b/src/fe-common/core/fe-windows.c
index 46c1593b..0afa2914 100644
--- a/src/fe-common/core/fe-windows.c
+++ b/src/fe-common/core/fe-windows.c
@@ -35,30 +35,83 @@
 
 GSList *windows; /* first in the list is the active window,
                     next is the last active, etc. */
+GSequence *windows_seq;
 WINDOW_REC *active_win;
 
 static int daytag;
 static int daycheck; /* 0 = don't check, 1 = time is 00:00, check,
                         2 = time is 00:00, already checked */
 
+static int window_refnum_lookup(WINDOW_REC *window, void *refnum_p)
+{
+	int refnum = GPOINTER_TO_INT(refnum_p);
+	return window->refnum == refnum ? 0 : window->refnum < refnum ? -1 : 1;
+}
+
+static GSequenceIter *windows_seq_begin(void)
+{
+	return g_sequence_get_begin_iter(windows_seq);
+}
+
+static GSequenceIter *windows_seq_end(void)
+{
+	return g_sequence_get_end_iter(windows_seq);
+}
+
+static GSequenceIter *windows_seq_insert(WINDOW_REC *rec)
+{
+	return g_sequence_insert_sorted(windows_seq, rec, (GCompareDataFunc)window_refnum_cmp, NULL);
+}
+
+static GSequenceIter *windows_seq_refnum_lookup(int refnum)
+{
+	return g_sequence_lookup(windows_seq, GINT_TO_POINTER(refnum), (GCompareDataFunc)window_refnum_lookup, NULL);
+}
+
+static void windows_seq_changed(GSequenceIter *iter)
+{
+	g_sequence_sort_changed(iter, (GCompareDataFunc)window_refnum_cmp, NULL);
+}
+
+static GSequenceIter *windows_seq_window_lookup(WINDOW_REC *rec)
+{
+	return g_sequence_lookup(windows_seq, rec, (GCompareDataFunc)window_refnum_cmp, NULL);
+}
+
+/* search to the numerically right iterator of refnum */
+static GSequenceIter *windows_seq_refnum_search_right(int refnum)
+{
+	return g_sequence_search(windows_seq, GINT_TO_POINTER(refnum), (GCompareDataFunc)window_refnum_lookup, NULL);
+}
+
+/* we want to find the numerically left iterator of refnum, so we
+   search the right of the previous refnum. but we need to figure out
+   the case where the iterator is already at the beginning, i.e
+   iter->refnum >= refnum */
+static GSequenceIter *windows_seq_refnum_search_left(int refnum)
+{
+	GSequenceIter *iter = windows_seq_refnum_search_right(refnum - 1);
+	return iter == windows_seq_begin() ? NULL : g_sequence_iter_prev(iter);
+}
+
 static int window_get_new_refnum(void)
 {
 	WINDOW_REC *win;
-	GSList *tmp;
+	GSequenceIter *iter, *end;
 	int refnum;
 
 	refnum = 1;
-	tmp = windows;
-	while (tmp != NULL) {
-		win = tmp->data;
+	iter = windows_seq_begin();
+	end = windows_seq_end();
 
-		if (refnum != win->refnum) {
-			tmp = tmp->next;
-			continue;
-		}
+	while (iter != end) {
+		win = g_sequence_get(iter);
+
+		if (refnum != win->refnum)
+			return refnum;
 
 		refnum++;
-		tmp = windows;
+		iter = g_sequence_iter_next(iter);
 	}
 
 	return refnum;
@@ -73,6 +126,7 @@ WINDOW_REC *window_create(WI_ITEM_REC *item, int automatic)
 	rec->level = settings_get_level("window_default_level");
 
 	windows = g_slist_prepend(windows, rec);
+	windows_seq_insert(rec);
 	signal_emit("window created", 2, rec, GINT_TO_POINTER(automatic));
 
 	if (item != NULL) window_item_add(rec, item, automatic);
@@ -84,6 +138,19 @@ WINDOW_REC *window_create(WI_ITEM_REC *item, int automatic)
 	return rec;
 }
 
+static void window_set_refnum0(WINDOW_REC *window, int refnum)
+{
+	int old_refnum;
+
+	g_return_if_fail(window != NULL);
+	g_return_if_fail(refnum >= 1);
+	if (window->refnum == refnum) return;
+
+	old_refnum = window->refnum;
+	window->refnum = refnum;
+	signal_emit("window refnum changed", 2, window, GINT_TO_POINTER(old_refnum));
+}
+
 /* removed_refnum was removed from the windows list, pack the windows so
    there won't be any holes. If there is any holes after removed_refnum,
    leave the windows behind it alone. */
@@ -91,23 +158,37 @@ static void windows_pack(int removed_refnum)
 {
 	WINDOW_REC *window;
 	int refnum;
+	GSequenceIter *iter, *end;
+
+	refnum = removed_refnum + 1;
+	end = windows_seq_end();
+	iter = windows_seq_refnum_lookup(refnum);
+	if (iter == NULL) return;
+
+	while (iter != end) {
+		window = g_sequence_get(iter);
 
-	for (refnum = removed_refnum+1;; refnum++) {
-		window = window_find_refnum(refnum);
-		if (window == NULL || window->sticky_refnum)
+		if (window == NULL || window->sticky_refnum || window->refnum != refnum)
 			break;
 
-		window_set_refnum(window, refnum-1);
+		window_set_refnum0(window, refnum - 1);
+		windows_seq_changed(iter);
+
+		refnum++;
+		iter = g_sequence_iter_next(iter);
 	}
 }
 
 void window_destroy(WINDOW_REC *window)
 {
+	GSequenceIter *iter;
 	g_return_if_fail(window != NULL);
 
 	if (window->destroying) return;
 	window->destroying = TRUE;
 	windows = g_slist_remove(windows, window);
+	iter = windows_seq_window_lookup(window);
+	if (iter != NULL) g_sequence_remove(iter);
 
 	if (active_win == window) {
 		active_win = NULL; /* it's corrupted */
@@ -189,26 +270,32 @@ void window_change_server(WINDOW_REC *window, void *server)
 
 void window_set_refnum(WINDOW_REC *window, int refnum)
 {
-	GSList *tmp;
+	GSequenceIter *other_iter, *window_iter;
 	int old_refnum;
 
 	g_return_if_fail(window != NULL);
 	g_return_if_fail(refnum >= 1);
 	if (window->refnum == refnum) return;
 
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	other_iter = windows_seq_refnum_lookup(refnum);
+	window_iter = windows_seq_refnum_lookup(window->refnum);
 
-		if (rec->refnum == refnum) {
-			rec->refnum = window->refnum;
-                        signal_emit("window refnum changed", 2, rec, GINT_TO_POINTER(refnum));
-			break;
-		}
+	if (other_iter != NULL) {
+		WINDOW_REC *rec = g_sequence_get(other_iter);
+
+		rec->refnum = window->refnum;
+		signal_emit("window refnum changed", 2, rec, GINT_TO_POINTER(refnum));
 	}
 
 	old_refnum = window->refnum;
 	window->refnum = refnum;
 	signal_emit("window refnum changed", 2, window, GINT_TO_POINTER(old_refnum));
+
+	if (window_iter != NULL && other_iter != NULL) {
+		g_sequence_swap(other_iter, window_iter);
+	} else {
+		windows_seq_changed(window_iter);
+	}
 }
 
 void window_set_name(WINDOW_REC *window, const char *name)
@@ -346,13 +433,13 @@ WINDOW_REC *window_find_closest(void *server, const char *name, int level)
 
 WINDOW_REC *window_find_refnum(int refnum)
 {
-	GSList *tmp;
+	GSequenceIter *iter;
 
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	iter = windows_seq_refnum_lookup(refnum);
+	if (iter != NULL) {
+		WINDOW_REC *rec = g_sequence_get(iter);
 
-		if (rec->refnum == refnum)
-			return rec;
+		return rec;
 	}
 
 	return NULL;
@@ -400,71 +487,86 @@ WINDOW_REC *window_find_item(SERVER_REC *server, const char *name)
 
 int window_refnum_prev(int refnum, int wrap)
 {
-	GSList *tmp;
-	int prev, max;
+	WINDOW_REC *rec;
+	GSequenceIter *iter, *end;
 
-	max = prev = -1;
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	iter = windows_seq_refnum_search_left(refnum);
+	end = windows_seq_end();
 
-		if (rec->refnum < refnum && (prev == -1 || rec->refnum > prev))
-			prev = rec->refnum;
-		if (wrap && (max == -1 || rec->refnum > max))
-			max = rec->refnum;
+	if (iter != NULL) {
+		rec = g_sequence_get(iter);
+		return rec->refnum;
+	}
+
+	if (wrap) {
+		iter = g_sequence_iter_prev(end);
+		if (iter != end) {
+			rec = g_sequence_get(iter);
+			return rec->refnum;
+		}
 	}
 
-	return prev != -1 ? prev : max;
+	return -1;
 }
 
 int window_refnum_next(int refnum, int wrap)
 {
-	GSList *tmp;
-	int min, next;
+	WINDOW_REC *rec;
+	GSequenceIter *iter, *end;
 
-	min = next = -1;
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	iter = windows_seq_refnum_search_right(refnum);
+	end = windows_seq_end();
+
+	if (iter != end) {
+		rec = g_sequence_get(iter);
+		return rec->refnum;
+	}
 
-		if (rec->refnum > refnum && (next == -1 || rec->refnum < next))
-			next = rec->refnum;
-		if (wrap && (min == -1 || rec->refnum < min))
-			min = rec->refnum;
+	if (wrap) {
+		iter = windows_seq_begin();
+		if (iter != end) {
+			rec = g_sequence_get(iter);
+			return rec->refnum;
+		}
 	}
 
-	return next != -1 ? next : min;
+	return -1;
 }
 
 int windows_refnum_last(void)
 {
-	GSList *tmp;
-	int max;
-
-	max = -1;
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	WINDOW_REC *rec;
+	GSequenceIter *end, *iter;
 
-		if (rec->refnum > max)
-			max = rec->refnum;
+	end = windows_seq_end();
+	iter = g_sequence_iter_prev(end);
+	if (iter != end) {
+		rec = g_sequence_get(iter);
+		return rec->refnum;
 	}
 
-	return max;
+	return -1;
 }
 
 int window_refnum_cmp(WINDOW_REC *w1, WINDOW_REC *w2)
 {
-	return w1->refnum < w2->refnum ? -1 : 1;
+	return w1 == w2 ? 0 : w1->refnum < w2->refnum ? -1 : 1;
 }
 
 GSList *windows_get_sorted(void)
 {
-	GSList *tmp, *sorted;
+	GSequenceIter *iter, *begin;
+	GSList *sorted;
 
         sorted = NULL;
-	for (tmp = windows; tmp != NULL; tmp = tmp->next) {
-		WINDOW_REC *rec = tmp->data;
+	iter = windows_seq_end();
+	begin = windows_seq_begin();
+
+	while (iter != begin) {
+		iter = g_sequence_iter_prev(iter);
+		WINDOW_REC *rec = g_sequence_get(iter);
 
-		sorted = g_slist_insert_sorted(sorted, rec, (GCompareFunc)
-					       window_refnum_cmp);
+		sorted = g_slist_prepend(sorted, rec);
 	}
 
         return sorted;
@@ -709,6 +811,7 @@ static void read_settings(void)
 void windows_init(void)
 {
 	active_win = NULL;
+	windows_seq = g_sequence_new(NULL);
 	daycheck = 0; daytag = -1;
 	settings_add_bool("lookandfeel", "window_auto_change", FALSE);
 	settings_add_bool("lookandfeel", "windows_auto_renumber", TRUE);
@@ -733,4 +836,6 @@ void windows_deinit(void)
 	signal_remove("server disconnected", (SIGNAL_FUNC) sig_server_disconnected);
 	signal_remove("server connect failed", (SIGNAL_FUNC) sig_server_disconnected);
 	signal_remove("setup changed", (SIGNAL_FUNC) read_settings);
+	g_sequence_free(windows_seq);
+	windows_seq = NULL;
 }
diff --git a/src/fe-common/core/hilight-text.c b/src/fe-common/core/hilight-text.c
index 4691a708..037cde5c 100644
--- a/src/fe-common/core/hilight-text.c
+++ b/src/fe-common/core/hilight-text.c
@@ -101,7 +101,9 @@ static void hilight_destroy(HILIGHT_REC *rec)
 {
 	g_return_if_fail(rec != NULL);
 
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+	if (rec->preg != NULL) g_regex_unref(rec->preg);
+#else
 	if (rec->regexp_compiled) regfree(&rec->preg);
 #endif
 	if (rec->channels != NULL) g_strfreev(rec->channels);
@@ -120,7 +122,12 @@ static void hilights_destroy_all(void)
 
 static void hilight_init_rec(HILIGHT_REC *rec)
 {
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+	if (rec->preg != NULL)
+		g_regex_unref(rec->preg);
+
+	rec->preg = g_regex_new(rec->text, G_REGEX_OPTIMIZE | G_REGEX_RAW | G_REGEX_CASELESS, 0, NULL);
+#else
 	if (rec->regexp_compiled) regfree(&rec->preg);
 	if (!rec->regexp)
 		rec->regexp_compiled = FALSE;
@@ -194,13 +201,24 @@ static HILIGHT_REC *hilight_find(const char *text, char **channels)
 	return NULL;
 }
 
-static int hilight_match_text(HILIGHT_REC *rec, const char *text,
+static gboolean hilight_match_text(HILIGHT_REC *rec, const char *text,
 				  int *match_beg, int *match_end)
 {
-	char *match;
+	gboolean ret = FALSE;
 
 	if (rec->regexp) {
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+		if (rec->preg != NULL) {
+			GMatchInfo *match;
+
+			g_regex_match (rec->preg, text, 0, &match);
+
+			if (g_match_info_matches(match))
+				ret = g_match_info_fetch_pos(match, 0, match_beg, match_end);
+
+			g_match_info_free(match);
+		}
+#else
 		regmatch_t rmatch[1];
 
 		if (rec->regexp_compiled &&
@@ -210,10 +228,12 @@ static int hilight_match_text(HILIGHT_REC *rec, const char *text,
 				*match_beg = rmatch[0].rm_so;
 				*match_end = rmatch[0].rm_eo;
 			}
-			return TRUE;
+			ret = TRUE;
 		}
 #endif
 	} else {
+		char *match;
+
 		if (rec->case_sensitive) {
 			match = rec->fullword ?
 				strstr_full(text, rec->text) :
@@ -228,11 +248,11 @@ static int hilight_match_text(HILIGHT_REC *rec, const char *text,
 				*match_beg = (int) (match-text);
 				*match_end = *match_beg + strlen(rec->text);
 			}
-			return TRUE;
+			ret = TRUE;
 		}
 	}
 
-	return FALSE;
+	return ret;
 }
 
 #define hilight_match_level(rec, level) \
@@ -509,7 +529,10 @@ static void hilight_print(int index, HILIGHT_REC *rec)
 	if (rec->case_sensitive) g_string_append(options, "-matchcase ");
 	if (rec->regexp) {
 		g_string_append(options, "-regexp ");
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+		if (rec->preg == NULL)
+			g_string_append(options, "[INVALID!] ");
+#else
 		if (!rec->regexp_compiled)
 			g_string_append(options, "[INVALID!] ");
 #endif
diff --git a/src/fe-common/core/hilight-text.h b/src/fe-common/core/hilight-text.h
index ae05e1ca..76beec1f 100644
--- a/src/fe-common/core/hilight-text.h
+++ b/src/fe-common/core/hilight-text.h
@@ -1,7 +1,7 @@
 #ifndef __HILIGHT_TEXT_H
 #define __HILIGHT_TEXT_H
 
-#ifdef HAVE_REGEX_H
+#ifndef USE_GREGEX
 #  include <regex.h>
 #endif
 
@@ -24,7 +24,9 @@ struct _HILIGHT_REC {
 	unsigned int fullword:1; /* match `text' only for full words */
 	unsigned int regexp:1; /* `text' is a regular expression */
 	unsigned int case_sensitive:1;/* `text' must match case */
-#ifdef HAVE_REGEX_H
+#ifdef USE_GREGEX
+	GRegex *preg;
+#else
 	unsigned int regexp_compiled:1; /* should always be TRUE, unless regexp is invalid */
 	regex_t preg;
 #endif
diff --git a/src/fe-common/irc/fe-irc-queries.c b/src/fe-common/irc/fe-irc-queries.c
index b2faefbc..c928a94a 100644
--- a/src/fe-common/irc/fe-irc-queries.c
+++ b/src/fe-common/irc/fe-irc-queries.c
@@ -78,6 +78,13 @@ static void event_privmsg(SERVER_REC *server, const char *data,
 			if (!server_has_nick(server, query->name))
 				query_change_nick(query, nick);
 		}
+	} else {
+		/* process the changes to the query structure now, before the
+		 * privmsg is dispatched. */
+		if (g_strcmp0(query->name, nick) != 0)
+			query_change_nick(query, nick);
+		if (address != NULL && g_strcmp0(query->address, address) != 0)
+			query_change_address(query, address);
 	}
 }
 
diff --git a/src/fe-common/irc/fe-sasl.c b/src/fe-common/irc/fe-sasl.c
index 331b38b0..fc8105fc 100644
--- a/src/fe-common/irc/fe-sasl.c
+++ b/src/fe-common/irc/fe-sasl.c
@@ -1,7 +1,7 @@
 /*
     fe-sasl.c : irssi
 
-    Copyright (C) 2015 The Lemon Man
+    Copyright (C) 2015-2017 The Lemon Man
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -22,6 +22,11 @@
 #include "module-formats.h"
 #include "signals.h"
 #include "levels.h"
+#include "misc.h"
+#include "sasl.h"
+
+#include "irc-servers.h"
+#include "settings.h"
 
 #include "printtext.h"
 
@@ -35,14 +40,36 @@ static void sig_sasl_failure(IRC_SERVER_REC *server, const char *reason)
 	printformat(server, NULL, MSGLEVEL_CRAP, IRCTXT_SASL_ERROR, reason);
 }
 
+static void sig_cap_end(IRC_SERVER_REC *server)
+{
+	/* The negotiation has now been terminated, if we didn't manage to
+	 * authenticate successfully with the server just disconnect. */
+	if (!server->sasl_success &&
+	    server->connrec->sasl_mechanism != SASL_MECHANISM_NONE &&
+	    settings_get_bool("sasl_disconnect_on_failure")) {
+		/* We can't use server_disconnect() here because we'd end up
+		 * freeing the 'server' object and be guilty of a slew of UaF. */
+		server->connection_lost = TRUE;
+		/* By setting connection_lost we make sure the communication is
+		 * halted and when the control goes back to irc_parse_incoming
+		 * the server object is safely destroyed. */
+		signal_stop();
+	}
+
+}
+
 void fe_sasl_init(void)
 {
+	settings_add_bool("server", "sasl_disconnect_on_failure", TRUE);
+
 	signal_add("server sasl success", (SIGNAL_FUNC) sig_sasl_success);
 	signal_add("server sasl failure", (SIGNAL_FUNC) sig_sasl_failure);
+	signal_add_first("server cap end", (SIGNAL_FUNC) sig_cap_end);
 }
 
 void fe_sasl_deinit(void)
 {
 	signal_remove("server sasl success", (SIGNAL_FUNC) sig_sasl_success);
 	signal_remove("server sasl failure", (SIGNAL_FUNC) sig_sasl_failure);
+	signal_remove("server cap end", (SIGNAL_FUNC) sig_cap_end);
 }