Merge branch 'fix-dcc' into 'security'

fix dcc

See merge request irssi/irssi!20

3 files changed, 46 insertions, 2 deletions

diff --git a/src/irc/dcc/dcc-chat.c b/src/irc/dcc/dcc-chat.c
index ca90b8d8..88c577f7 100644
--- a/src/irc/dcc/dcc-chat.c
+++ b/src/irc/dcc/dcc-chat.c
@@ -66,6 +66,13 @@ CHAT_DCC_REC *dcc_chat_create(IRC_SERVER_REC *server,
         dcc->id = dcc_chat_get_new_id(nick);
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change init_rec API */
+		g_free(dcc->id);
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -471,6 +478,7 @@ static void cmd_dcc_chat(const char *data, IRC_SERVER_REC *server)
 			/* We are accepting a passive DCC CHAT. */
 			dcc_chat_passive(dcc);
 		}
+		cmd_params_free(free_arg);
 		return;
 	}
 
@@ -485,6 +493,11 @@ static void cmd_dcc_chat(const char *data, IRC_SERVER_REC *server)
 		cmd_param_error(CMDERR_NOT_CONNECTED);
 
 	dcc = dcc_chat_create(server, NULL, nick, "chat");
+	if (dcc == NULL) {
+		cmd_params_free(free_arg);
+		g_warn_if_reached();
+		return;
+	}
 
 	if (g_hash_table_lookup(optlist, "passive") == NULL) {
 		/* Standard DCC CHAT... let's listen for incoming connections */
@@ -627,6 +640,9 @@ static void ctcp_msg_dcc_chat(IRC_SERVER_REC *server, const char *data,
 	}
 	passive = paramcount == 4 && g_strcmp0(params[2], "0") == 0;
 
+	if (nick == NULL)
+		nick = "";
+
 	dcc = DCC_CHAT(dcc_find_request(DCC_CHAT_TYPE, nick, NULL));
 	if (dcc != NULL) {
 		if (dcc_is_listening(dcc)) {
@@ -658,6 +674,11 @@ static void ctcp_msg_dcc_chat(IRC_SERVER_REC *server, const char *data,
 	}
 
 	dcc = dcc_chat_create(server, chat, nick, params[0]);
+	if (dcc == NULL) {
+		g_strfreev(params);
+		g_warn_if_reached();
+		return;
+	}
 	dcc->target = g_strdup(target);
 	dcc->port = atoi(params[2]);
 
diff --git a/src/irc/dcc/dcc-get.c b/src/irc/dcc/dcc-get.c
index 107f68fa..cecbb076 100644
--- a/src/irc/dcc/dcc-get.c
+++ b/src/irc/dcc/dcc-get.c
@@ -43,6 +43,12 @@ GET_DCC_REC *dcc_get_create(IRC_SERVER_REC *server, CHAT_DCC_REC *chat,
 	dcc->fhandle = -1;
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change API */
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -430,9 +436,10 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server, const char *data,
 	int p_id = -1;
 	int passive = FALSE;
 
-	if (addr == NULL) {
+	if (addr == NULL)
 		addr = "";
-	}
+	if (nick == NULL)
+		nick = "";
 
 	/* SEND <file name> <address> <port> <size> [...] */
 	/* SEND <file name> <address> 0 <size> <id> (DCC SEND passive protocol) */
@@ -512,6 +519,12 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server, const char *data,
 		dcc_destroy(DCC(dcc)); /* remove the old DCC */
 
 	dcc = dcc_get_create(server, chat, nick, fname);
+	if (dcc == NULL) {
+		g_free(address);
+		g_free(fname);
+		g_warn_if_reached();
+		return;
+	}
 	dcc->target = g_strdup(target);
 
 	if (passive && port == 0)
diff --git a/src/irc/dcc/dcc-send.c b/src/irc/dcc/dcc-send.c
index ca29b9b9..912129b7 100644
--- a/src/irc/dcc/dcc-send.c
+++ b/src/irc/dcc/dcc-send.c
@@ -237,6 +237,12 @@ static SEND_DCC_REC *dcc_send_create(IRC_SERVER_REC *server,
 	dcc->queue = -1;
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change API */
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -417,6 +423,10 @@ static int dcc_send_one_file(int queue, const char *target, const char *fname,
 
 	dcc = dcc_send_create(server, chat, target, str);
 	g_free(str);
+	if (dcc == NULL) {
+		g_warn_if_reached();
+		return FALSE;
+	}
 
 	dcc->handle = handle;
 	dcc->port = port;