From a4f8133e15978e0c131bac8d210b42c0715fe407 Mon Sep 17 00:00:00 2001 From: psychon Date: Wed, 18 Aug 2010 07:57:23 +0000 Subject: [PATCH] Fix a NULL pointer dereference in route_replies When there was only one client with a pending request and that client disconnected from ZNC, we didn't destroy the timeout. This means that the associated timer eventually fired and then tried to display which request caused the timeout. But since we already cleaned up the rest, this resulted in a NULL pointer dereference. This commit fixes also another bug: If two different clients got pending requests and the client whose request was currently handled disconnected, we didn't send the other client's request to the IRCd. git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@2102 726aef4b-f618-498e-8847-2d620e286838 --- configure | 20 ++++++++++---------- configure.in | 2 +- main.h | 4 +++- modules/route_replies.cpp | 7 ++++--- 4 files changed, 18 insertions(+), 15 deletions(-) diff --git a/configure b/configure index abff5946..0228d787 100755 --- a/configure +++ b/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.65 for znc 0.093. +# Generated by GNU Autoconf 2.65 for znc 0.094-rc1. # # # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, @@ -548,8 +548,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='znc' PACKAGE_TARNAME='znc' -PACKAGE_VERSION='0.093' -PACKAGE_STRING='znc 0.093' +PACKAGE_VERSION='0.094-rc1' +PACKAGE_STRING='znc 0.094-rc1' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1209,7 +1209,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures znc 0.093 to adapt to many kinds of systems. +\`configure' configures znc 0.094-rc1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1274,7 +1274,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of znc 0.093:";; + short | recursive ) echo "Configuration of znc 0.094-rc1:";; esac cat <<\_ACEOF @@ -1393,7 +1393,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -znc configure 0.093 +znc configure 0.094-rc1 generated by GNU Autoconf 2.65 Copyright (C) 2009 Free Software Foundation, Inc. @@ -1561,7 +1561,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by znc $as_me 0.093, which was +It was created by znc $as_me 0.094-rc1, which was generated by GNU Autoconf 2.65. Invocation command line was $ $0 $@ @@ -4530,7 +4530,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by znc $as_me 0.093, which was +This file was extended by znc $as_me 0.094-rc1, which was generated by GNU Autoconf 2.65. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -4583,7 +4583,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -znc config.status 0.093 +znc config.status 0.094-rc1 configured by $0, generated by GNU Autoconf 2.65, with options \\"\$ac_cs_config\\" @@ -5140,7 +5140,7 @@ fi echo -echo znc 0.093 configured +echo znc 0.094-rc1 configured echo echo "prefix: $prefix" echo "debug: $DEBUG" diff --git a/configure.in b/configure.in index 08896fa4..593ab272 100644 --- a/configure.in +++ b/configure.in @@ -1,5 +1,5 @@ dnl Keep the version number in sync with main.h! -AC_INIT([znc], [0.093]) +AC_INIT([znc], [0.094-rc1]) AC_CONFIG_SRCDIR([znc.cpp]) AC_LANG([C++]) diff --git a/main.h b/main.h index 74182106..2a5d86c2 100644 --- a/main.h +++ b/main.h @@ -11,7 +11,7 @@ // The following defines are for #if comparison (preprocessor only likes ints) #define VERSION_MAJOR 0 -#define VERSION_MINOR 93 +#define VERSION_MINOR 94 // This one is for display purpose #define VERSION (VERSION_MAJOR + VERSION_MINOR / 1000.0) @@ -19,6 +19,8 @@ #ifndef VERSION_EXTRA #define VERSION_EXTRA "" #endif +#undef VERSION_EXTRA +#define VERSION_EXTRA "-rc1" #ifndef _MODDIR_ #define _MODDIR_ "/usr/lib/znc" diff --git a/modules/route_replies.cpp b/modules/route_replies.cpp index a9bc110f..b6849bd9 100644 --- a/modules/route_replies.cpp +++ b/modules/route_replies.cpp @@ -195,16 +195,17 @@ public: if (m_pClient == m_pDoing) { // The replies which aren't received yet will be // broadcasted to everyone, but at least nothing breaks + RemTimer("RouteTimeout"); m_pDoing = NULL; m_pReplies = NULL; } it = m_vsPending.find(m_pClient); - if (it == m_vsPending.end()) - return; + if (it != m_vsPending.end()) + m_vsPending.erase(it); - m_vsPending.erase(it); + SendRequest(); } virtual EModRet OnRaw(CString& sLine)