srvx-commits

[Entrope <en...@us...>]

Update of /cvsroot/srvx/services/src
In directory sc8-pr-cvs1:/tmp/cvs-serv26008/src

Modified Files:
	chanserv.c 
Log Message:
fix a read-after-free when unregistering a channel


Index: chanserv.c
===================================================================
RCS file: /cvsroot/srvx/services/src/chanserv.c,v
retrieving revision 1.399
retrieving revision 1.400
diff -C2 -r1.399 -r1.400
*** chanserv.c	13 Dec 2003 16:55:51 -0000	1.399
--- chanserv.c	15 Dec 2003 18:38:58 -0000	1.400
***************
*** 1444,1469 ****
              free(suspended->suspender);
              free(suspended->reason);
!             if(suspended->expires) timeq_del(suspended->expires, chanserv_expire_suspension, suspended, 0);
              free(suspended);
          }
  
  	if(cNode)
- 	{
  	    cNode->channel_info = NULL;
- 	}
      }
- 
      channel->channel->channel_info = NULL;
-     UnlockChannel(channel->channel);
  
!     if(channel->notes) dict_delete(channel->notes);
!     sprintf(msgbuf, "%s %s", channel->channel->name, reason);
      if(!IsSuspended(channel))
-     {
          DelChannelUser(chanserv, channel->channel, msgbuf, 0);
!     }
      global_message(MESSAGE_RECIPIENT_OPERS | MESSAGE_RECIPIENT_HELPERS, msgbuf);
      free(channel);
- 
      registered_channels--;
  }
--- 1444,1465 ----
              free(suspended->suspender);
              free(suspended->reason);
!             if(suspended->expires)
!                 timeq_del(suspended->expires, chanserv_expire_suspension, suspended, 0);
              free(suspended);
          }
  
  	if(cNode)
  	    cNode->channel_info = NULL;
      }
      channel->channel->channel_info = NULL;
  
!     if(channel->notes)
!         dict_delete(channel->notes);
      if(!IsSuspended(channel))
          DelChannelUser(chanserv, channel->channel, msgbuf, 0);
!     sprintf(msgbuf, "%s %s", channel->channel->name, reason);
      global_message(MESSAGE_RECIPIENT_OPERS | MESSAGE_RECIPIENT_HELPERS, msgbuf);
+     UnlockChannel(channel->channel);
      free(channel);
      registered_channels--;
  }