aboutsummaryrefslogtreecommitdiffstats
path: root/main/ngircd/CVE-2020-14148.patch
blob: 2f2d2b5038e9a6aa229dcef94b1a85ad0a670099 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
From 02cf31c0e267a4c9a7656d43ad3ad4eeb37fc9c5 Mon Sep 17 00:00:00 2001
From: Alexander Barton <alex@barton.de>
Date: Mon, 25 May 2020 23:43:29 +0200
Subject: [PATCH] IRC_SERVER: Make sure that the client sent a prefix

The SERVER command is only valid with a prefix when received from other
servers, so make sure that there is one and disconnect the peer if not
(instead of crashing ...).

This obsoletes PR #275.

Thanks Hilko Bengen (hillu) for finding & reporting this as well for the
patch & pull request! But I think this is the "more correct" fix.
---
 src/ngircd/irc-server.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/ngircd/irc-server.c b/src/ngircd/irc-server.c
index 317a3e1a..10f1ef69 100644
--- a/src/ngircd/irc-server.c
+++ b/src/ngircd/irc-server.c
@@ -186,6 +186,15 @@ IRC_SERVER( CLIENT *Client, REQUEST *Req )
 		if (!Client_CheckID(Client, Req->argv[0]))
 			return DISCONNECTED;
 
+		if (!Req->prefix) {
+			/* We definitely need a prefix here! */
+			Log(LOG_ALERT, "Got SERVER command without prefix! (on connection %d)",
+			    Client_Conn(Client));
+			Conn_Close(Client_Conn(Client), NULL,
+				   "SERVER command without prefix", true);
+			return DISCONNECTED;
+		}
+
 		from = Client_Search( Req->prefix );
 		if (! from) {
 			/* Uh, Server, that introduced the new server is unknown?! */