Merge branch 'security' into 'master'

Security

See merge request irssi/irssi!34

3 files changed, 25 insertions, 28 deletions

diff --git a/src/fe-common/core/chat-completion.c b/src/fe-common/core/chat-completion.c
index 7ecdd4a2..d610008f 100644
--- a/src/fe-common/core/chat-completion.c
+++ b/src/fe-common/core/chat-completion.c
@@ -173,6 +173,7 @@ static void sig_message_public(SERVER_REC *server, const char *msg,
 {
 	CHANNEL_REC *channel;
         int own;
+	g_return_if_fail(nick != NULL);
 
 	channel = channel_find(server, target);
 	if (channel != NULL) {
@@ -185,6 +186,7 @@ static void sig_message_join(SERVER_REC *server, const char *channel,
 			     const char *nick, const char *address)
 {
 	CHANNEL_REC *chanrec;
+	g_return_if_fail(nick != NULL);
 
 	chanrec = channel_find(server, channel);
 	if (chanrec != NULL)
diff --git a/src/fe-common/irc/fe-irc-commands.c b/src/fe-common/irc/fe-irc-commands.c
index 11a911d2..7a6b17a6 100644
--- a/src/fe-common/irc/fe-irc-commands.c
+++ b/src/fe-common/irc/fe-irc-commands.c
@@ -345,16 +345,18 @@ static void cmd_ts(const char *data)
 }
 
 typedef struct {
-	IRC_SERVER_REC *server;
+	char *server_tag;
 	char *nick;
 } OPER_PASS_REC;
 
 static void cmd_oper_got_pass(const char *password, OPER_PASS_REC *rec)
 {
-        if (*password != '\0')
-		irc_send_cmdv(rec->server, "OPER %s %s", rec->nick, password);
+	SERVER_REC *server_rec = server_find_tag(rec->server_tag);
+	if (*password != '\0' && IS_IRC_SERVER(server_rec))
+		irc_send_cmdv((IRC_SERVER_REC *) server_rec, "OPER %s %s", rec->nick, password);
 	g_free(rec->nick);
-        g_free(rec);
+	g_free(rec->server_tag);
+	g_free(rec);
 }
 
 static void cmd_oper(const char *data, IRC_SERVER_REC *server)
@@ -374,7 +376,7 @@ static void cmd_oper(const char *data, IRC_SERVER_REC *server)
 		OPER_PASS_REC *rec;
 
 		rec = g_new(OPER_PASS_REC, 1);
-		rec->server = server;
+		rec->server_tag = g_strdup(server->tag);
 		rec->nick = g_strdup(*nick != '\0' ? nick : server->nick);
 
 		format = format_get_text(MODULE_NAME, NULL, server, NULL,
diff --git a/src/irc/core/sasl.c b/src/irc/core/sasl.c
index 2b589579..c5aa2caa 100644
--- a/src/irc/core/sasl.c
+++ b/src/irc/core/sasl.c
@@ -55,10 +55,21 @@ static gboolean sasl_timeout(IRC_SERVER_REC *server)
 	return FALSE;
 }
 
+static void sasl_timeout_stop(IRC_SERVER_REC *server)
+{
+	/* Stop any pending timeout, if any */
+	if (server->sasl_timeout != 0) {
+		g_source_remove(server->sasl_timeout);
+		server->sasl_timeout = 0;
+	}
+}
+
 static void sasl_start(IRC_SERVER_REC *server, const char *data, const char *from)
 {
 	IRC_SERVER_CONNECT_REC *conn;
 
+	sasl_timeout_stop(server);
+
 	conn = server->connrec;
 
 	switch (conn->sasl_mechanism) {
@@ -77,11 +88,6 @@ static void sasl_fail(IRC_SERVER_REC *server, const char *data, const char *from
 {
 	char *params, *error;
 
-	/* Stop any pending timeout, if any */
-	if (server->sasl_timeout != 0) {
-		g_source_remove(server->sasl_timeout);
-		server->sasl_timeout = 0;
-	}
 
 	params = event_get_params(data, 2, NULL, &error);
 
@@ -97,10 +103,7 @@ static void sasl_fail(IRC_SERVER_REC *server, const char *data, const char *from
 
 static void sasl_already(IRC_SERVER_REC *server, const char *data, const char *from)
 {
-	if (server->sasl_timeout != 0) {
-		g_source_remove(server->sasl_timeout);
-		server->sasl_timeout = 0;
-	}
+	sasl_timeout_stop(server);
 
 	server->sasl_success = TRUE;
 
@@ -112,10 +115,7 @@ static void sasl_already(IRC_SERVER_REC *server, const char *data, const char *f
 
 static void sasl_success(IRC_SERVER_REC *server, const char *data, const char *from)
 {
-	if (server->sasl_timeout != 0) {
-		g_source_remove(server->sasl_timeout);
-		server->sasl_timeout = 0;
-	}
+	sasl_timeout_stop(server);
 
 	server->sasl_success = TRUE;
 
@@ -265,7 +265,7 @@ static void sasl_step_fail(IRC_SERVER_REC *server)
 	irc_send_cmd_now(server, "AUTHENTICATE *");
 	cap_finish_negotiation(server);
 
-	server->sasl_timeout = 0;
+	sasl_timeout_stop(server);
 
 	signal_emit("server sasl failure", 2, server, "The server sent an invalid payload");
 }
@@ -274,11 +274,7 @@ static void sasl_step(IRC_SERVER_REC *server, const char *data, const char *from
 {
 	GString *req = NULL;
 
-	/* Stop the timer */
-	if (server->sasl_timeout != 0) {
-		g_source_remove(server->sasl_timeout);
-		server->sasl_timeout = 0;
-	}
+	sasl_timeout_stop(server);
 
 	if (!sasl_reassemble_incoming(server, data, &req)) {
 		sasl_step_fail(server);
@@ -302,10 +298,7 @@ static void sasl_disconnected(IRC_SERVER_REC *server)
 		return;
 	}
 
-	if (server->sasl_timeout != 0) {
-		g_source_remove(server->sasl_timeout);
-		server->sasl_timeout = 0;
-	}
+	sasl_timeout_stop(server);
 }
 
 void sasl_init(void)