fixed double free or corruption in nickserv.c
authorpk910 <philipp@zoelle1.de>
Thu, 28 Jun 2012 06:34:12 +0000 (08:34 +0200)
committerpk910 <philipp@zoelle1.de>
Thu, 28 Jun 2012 06:36:01 +0000 (08:36 +0200)
src/nickserv.c

index d98c369c4530ffc21f00d6688bb855a927419489..b9931de907b2be615401eec661d972b369502326 100644 (file)
@@ -703,9 +703,9 @@ staff_has_access(struct userNode *user, struct userNode *bot, unsigned int min_l
     }
 
     if (user->handle_info->staff_level < min_level) {
-       if (!quiet)
+        if (!quiet)
             send_message(user, bot, "NSMSG_NO_ACCESS");
-       return 0;
+        return 0;
     }
 
     return 1;
@@ -3006,8 +3006,8 @@ static OPTION_FUNC(opt_staff_level)
     int res;
 
     if (!override) {
-       send_message(user, nickserv, "MSG_SETTING_PRIVILEGED", argv[0]);
-       return 0;
+        send_message(user, nickserv, "MSG_SETTING_PRIVILEGED", argv[0]);
+        return 0;
     }
 
     res = (argc > 1) ? oper_try_set_staff_access(user, nickserv, hi, strtoul(argv[1], NULL, 0)) : 0;
@@ -4768,19 +4768,18 @@ check_user_nick(struct userNode *user) {
     //check if this user is a pending LOC user
     if(pendingLOCUsers) {
         struct pendingLOCUser *pending, *next, *prev = NULL;
+        int remove;
         for(pending = pendingLOCUsers; pending; pending = next) {
             next = pending->next;
+            remove = 0;
             if(user->handle_info == pending->handle_info) {
                 pending->authlog->user = user;
                 free((char*) pending->authlog->hostmask);
                 pending->authlog->hostmask = generate_hostmask(user, GENMASK_USENICK|GENMASK_STRICT_IDENT|GENMASK_NO_HIDING|GENMASK_STRICT_HOST);
-                if(prev)
-                    prev->next = next;
-                else
-                    pendingLOCUsers = next;
-                free(pending);
-            }
-            if(now - pending->time > 10) {
+                remove = 1;
+            } else if(now - pending->time > 10)
+                remove = 1;
+            if(remove) {
                 if(prev)
                     prev->next = next;
                 else