adam/znc
1
0
Fork 0
mirror of https://github.com/znc/znc.git synced 2026-08-08 09:52:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a NULL pointer dereference in route_replies

Browse Source 
When there was only one client with a pending request and that client
disconnected from ZNC, we didn't destroy the timeout. This means that the
associated timer eventually fired and then tried to display which request caused
the timeout. But since we already cleaned up the rest, this resulted in a NULL
pointer dereference.

This commit fixes also another bug: If two different clients got pending
requests and the client whose request was currently handled disconnected, we
didn't send the other client's request to the IRCd.


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@2102 726aef4b-f618-498e-8847-2d620e286838
This commit is contained in:
psychon
2010-08-18 07:57:23 +00:00
parent c26ef8d45f
commit a4f8133e15
4 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/route_replies.cpp
+4 -3
View File
@@ -195,16 +195,17 @@ public:
if (m_pClient == m_pDoing) {
// The replies which aren't received yet will be
// broadcasted to everyone, but at least nothing breaks
RemTimer("RouteTimeout");
m_pDoing = NULL;
m_pReplies = NULL;
}
it = m_vsPending.find(m_pClient);
if (it == m_vsPending.end())
return;
if (it != m_vsPending.end())
m_vsPending.erase(it);
m_vsPending.erase(it);
SendRequest();
}
virtual EModRet OnRaw(CString& sLine)