From 8fdb530ee321fe0b5a7b0ba5d409c170d8091178 Mon Sep 17 00:00:00 2001
From: Alexey Sokolov <alexey+znc@asokolov.org>
Date: Sun, 31 Mar 2013 23:38:04 +0700
Subject: [PATCH] Fix use-after-free which may happen during shutdown

If a module, e.g. keepnick, tries to remove a timer in
OnIRCDisconnected.

Thanks to KindOne for the report.
---
 modules/keepnick.cpp | 2 +-
 src/znc.cpp          | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/keepnick.cpp b/modules/keepnick.cpp
index ad40b1fe..b20d82fb 100644
--- a/modules/keepnick.cpp
+++ b/modules/keepnick.cpp
@@ -121,7 +121,7 @@ public:
 			return;
 
 		m_pTimer->Stop();
-		RemTimer(m_pTimer->GetName());
+		RemTimer(m_pTimer);
 		m_pTimer = NULL;
 	}
 
diff --git a/src/znc.cpp b/src/znc.cpp
index c2a9432b..8421bf51 100644
--- a/src/znc.cpp
+++ b/src/znc.cpp
@@ -51,6 +51,11 @@ CZNC::~CZNC() {
 
 	for (map<CString,CUser*>::iterator a = m_msUsers.begin(); a != m_msUsers.end(); ++a) {
 		a->second->GetModules().UnloadAll();
+
+		const vector<CIRCNetwork*>& networks = a->second->GetNetworks();
+		for (vector<CIRCNetwork*>::const_iterator b = networks.begin(); b != networks.end(); ++b) {
+			(*b)->GetModules().UnloadAll();
+		}
 	}
 
 	for (size_t b = 0; b < m_vpListeners.size(); b++) {