Skip to content

Commit

Permalink
Avoid calling IRC_KillClient with Client == NULL
Browse files Browse the repository at this point in the history
I'm not familiar enough with the ngircd codebase, so I am not entirely
sure if `Client` is the right variable to pass to `KillClient` or if
it should be `c` instead.

This crash was found using American Fuzzy Lop.

Build flags:

    ./configure --without-syslog --with-iconv CC=afl-clang

Run mode:

    ngircd -n -f src/testsuite/ngircd-test1.conf

Manually inimized input:

    PASS pwd1 0210-IRC+ Cd|t0:CHLMSX P
    SERVER ngircd.test.server3 :on
    :ngi 376 ngircd.test.server
    :ngircd.test.server3 NICK NickNa.e 1 ~ locst 1 + :e
    :ngircd.test.server3  JOIN #Channel :e.eEN
    :ngircd.test.server3 NICK NickName 1 ~ locst 1 + :e
    :ngircd.test.server3 NJOIN #Channel :@Nickname,,,ngircd.test.server3!d

Stacktrace:

    #0  Client_ID (Client=0x0) at client.c:707
    #1  0x000000000042570c in IRC_KillClient (Client=0x0, From=0x0,
        Nick=0x7fffffffd00c "ngircd.test.server3!d", Reason=<optimized out>) at irc.c:379
    ngircd#2  0x000000000044050a in IRC_NJOIN (Client=0x47d6b0, Req=0x7fffffffd260) at irc-server.c:291
    ngircd#3  0x0000000000447eb7 in Handle_Request (Idx=<optimized out>, Req=0x7fffffffd260) at parse.c:544
    ngircd#4  Parse_Request (Idx=7, Request=<optimized out>) at parse.c:267
    ngircd#5  0x000000000041e788 in Handle_Buffer (Idx=7) at conn.c:1817
    ngircd#6  0x00000000004206f9 in Read_Request (Idx=7) at conn.c:1650
    ngircd#7  cb_clientserver (sock=7, what=<optimized out>) at conn.c:297
    ngircd#8  0x0000000000424bd0 in io_docallback (fd=7, what=<optimized out>) at io.c:924
    ngircd#9  io_dispatch_epoll (tv=<optimized out>) at io.c:497
    ngircd#10 io_dispatch (tv=<optimized out>) at io.c:896
    ngircd#11 0x000000000041defd in Conn_Handler () at conn.c:766
    ngircd#12 0x0000000000405489 in main (argc=<optimized out>, argv=<optimized out>) at ngircd.c:317
  • Loading branch information
hillu committed May 10, 2020
1 parent 03aec7d commit fe92b8d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/ngircd/irc-server.c
Original file line number Diff line number Diff line change
Expand Up @@ -288,7 +288,7 @@ IRC_NJOIN( CLIENT *Client, REQUEST *Req )
Log(LOG_ALERT,
"Failed to join client \"%s\" to channel \"%s\" (NJOIN): killing it!",
ptr, channame);
IRC_KillClient(NULL, NULL, ptr, "Internal NJOIN error!");
IRC_KillClient(Client, NULL, ptr, "Internal NJOIN error!");
Log(LOG_DEBUG, "... done.");
goto skip_njoin;
}
Expand Down

0 comments on commit fe92b8d

Please sign in to comment.