From 57fd78c7ef01d78b939698da6040c7164ff6647d Mon Sep 17 00:00:00 2001
From: pk910 <philipp@zoelle1.de>
Date: Thu, 28 Jun 2012 08:34:12 +0200
Subject: [PATCH] fixed double free or corruption in nickserv.c

---
 src/nickserv.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/src/nickserv.c b/src/nickserv.c
index d98c369..b9931de 100644
--- a/src/nickserv.c
+++ b/src/nickserv.c
@@ -703,9 +703,9 @@ staff_has_access(struct userNode *user, struct userNode *bot, unsigned int min_l
     }
 
     if (user->handle_info->staff_level < min_level) {
-	if (!quiet)
+        if (!quiet)
             send_message(user, bot, "NSMSG_NO_ACCESS");
-	return 0;
+        return 0;
     }
 
     return 1;
@@ -3006,8 +3006,8 @@ static OPTION_FUNC(opt_staff_level)
     int res;
 
     if (!override) {
-	send_message(user, nickserv, "MSG_SETTING_PRIVILEGED", argv[0]);
-	return 0;
+        send_message(user, nickserv, "MSG_SETTING_PRIVILEGED", argv[0]);
+        return 0;
     }
 
     res = (argc > 1) ? oper_try_set_staff_access(user, nickserv, hi, strtoul(argv[1], NULL, 0)) : 0;
@@ -4768,19 +4768,18 @@ check_user_nick(struct userNode *user) {
     //check if this user is a pending LOC user
     if(pendingLOCUsers) {
         struct pendingLOCUser *pending, *next, *prev = NULL;
+        int remove;
         for(pending = pendingLOCUsers; pending; pending = next) {
             next = pending->next;
+            remove = 0;
             if(user->handle_info == pending->handle_info) {
                 pending->authlog->user = user;
                 free((char*) pending->authlog->hostmask);
                 pending->authlog->hostmask = generate_hostmask(user, GENMASK_USENICK|GENMASK_STRICT_IDENT|GENMASK_NO_HIDING|GENMASK_STRICT_HOST);
-                if(prev)
-                    prev->next = next;
-                else
-                    pendingLOCUsers = next;
-                free(pending);
-            }
-            if(now - pending->time > 10) {
+                remove = 1;
+            } else if(now - pending->time > 10)
+                remove = 1;
+            if(remove) {
                 if(prev)
                     prev->next = next;
                 else
-- 
2.20.1