summaryrefslogtreecommitdiff
path: root/net-irc/weechat/files/2.7-CVE-2020-8955.patch
blob: 0bad821f9130f5c899f54dd4741c433fed63eb1d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
From 6f4f147d8e86adf9ad34a8ffd7e7f1f23a7e74da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Helleu?= <flashcode@flashtux.org>
Date: Sat, 8 Feb 2020 20:24:50 +0100
Subject: [PATCH] irc: fix crash when receiving a malformed message 324
 (channel mode)

Thanks to Stuart Nevans Locke for reporting the issue.
---
 ChangeLog.adoc             |  1 +
 src/plugins/irc/irc-mode.c | 21 ++++++++++++---------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/src/plugins/irc/irc-mode.c b/src/plugins/irc/irc-mode.c
index 2237a344b..e79f0deb7 100644
--- a/src/plugins/irc/irc-mode.c
+++ b/src/plugins/irc/irc-mode.c
@@ -224,17 +224,20 @@ irc_mode_channel_update (struct t_irc_server *server,
                     current_arg++;
                 if (pos[0] == chanmode)
                 {
-                    chanmode_found = 1;
-                    if (set_flag == '+')
+                    if (!chanmode_found)
                     {
-                        str_mode[0] = pos[0];
-                        str_mode[1] = '\0';
-                        strcat (new_modes, str_mode);
-                        if (argument)
+                        chanmode_found = 1;
+                        if (set_flag == '+')
                         {
-                            if (new_args[0])
-                                strcat (new_args, " ");
-                            strcat (new_args, argument);
+                            str_mode[0] = pos[0];
+                            str_mode[1] = '\0';
+                            strcat (new_modes, str_mode);
+                            if (argument)
+                            {
+                                if (new_args[0])
+                                    strcat (new_args, " ");
+                                strcat (new_args, argument);
+                            }
                         }
                     }
                 }