repo: ngircd
action: commit
revision: 
path_from: 
revision_from: 41a23d20e4bb5dfaebc7be3241addc5251ebc158:
path_to: 
revision_to: 

commit 41a23d20e4bb5dfaebc7be3241addc5251ebc158
Author: Alexander Barton 
Date:   Sun Aug 17 17:13:39 2008 +0200

    SECURITY: Fixed a message handling bug which could crash the daemon.

    Some message targets could lead to a NULL pointer dereference and therefore
    could crash the daemon (denial of service).
    (cherry picked from commit e493ad2d30ff80bca2556cde2212e367cb006517)

diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c

--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -397,7 +397,7 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 			for (cl = Client_First(); cl != NULL; cl = Client_Next(cl)) {
 				if (Client_Type(cl) != CLIENT_USER)
 					continue;
-				if (nick != NULL) {
+				if (nick != NULL && host != NULL) {
 					if (strcmp(nick, Client_ID(cl)) == 0 &&
 					    strcmp(user, Client_User(cl)) == 0 &&
 					    strcasecmp(host, Client_Hostname(cl)) == 0)

-----END OF PAGE-----