Merge branch 'security' into 'master'

Security

Closes GL#12, GL#13, GL#14, GL#15, GL#16

See merge request irssi/irssi!23

src/core/recode.c

@@ -198,7 +198,12 @@ char **recode_split(const SERVER_REC *server, const char *str,
 	int n = 0;
 	char **ret;
 
-	g_return_val_if_fail(str != NULL, NULL);
+	g_warn_if_fail(str != NULL);
+	if (str == NULL) {
+		ret = g_new(char *, 1);
+		ret[0] = NULL;
+		return ret;
+	}
 
 	if (settings_get_bool("recode")) {
 		to = find_conversion(server, target);

src/fe-common/core/themes.c

@@ -587,7 +587,7 @@ static char *theme_format_compress_colors(THEME_REC *theme, const char *format)
 			/* a normal character */
 			g_string_append_c(str, *format);
 			format++;
-		} else {
+		} else if (format[1] != '\0') {
 			/* %format */
 			format++;
 			if (IS_OLD_FORMAT(*format, last_fg, last_bg)) {
@@ -614,6 +614,11 @@ static char *theme_format_compress_colors(THEME_REC *theme, const char *format)
 					last_bg = '\0';
 			}
 			format++;
+		} else {
+			/* % at end of string */
+			format++;
+			g_string_append_c(str, '%');
+			g_string_append_c(str, '%');
 		}
 	}
 

src/irc/core/channel-events.c

@@ -37,7 +37,7 @@ static void check_join_failure(IRC_SERVER_REC *server, const char *channel)
 		channel++; /* server didn't understand !channels */
 
 	chanrec = channel_find(SERVER(server), channel);
-	if (chanrec == NULL && channel[0] == '!') {
+	if (chanrec == NULL && channel[0] == '!' && strlen(channel) > 6) {
 		/* it probably replied with the full !channel name,
 		   find the channel with the short name.. */
 		chan2 = g_strdup_printf("!%s", channel+6);

src/irc/core/channels-query.c

@@ -119,21 +119,22 @@ static void query_remove_all(IRC_CHANNEL_REC *channel)
 	int n;
 
 	rec = channel->server->chanqueries;
+	if (rec == NULL) return;
 
 	/* remove channel from query lists */
 	for (n = 0; n < CHANNEL_QUERIES; n++)
 		rec->queries[n] = g_slist_remove(rec->queries[n], channel);
 	rec->current_queries = g_slist_remove(rec->current_queries, channel);
 
-	query_check(channel->server);
+	if (!channel->server->disconnected)
+		query_check(channel->server);
 }
 
 static void sig_channel_destroyed(IRC_CHANNEL_REC *channel)
 {
 	g_return_if_fail(channel != NULL);
 
-	if (IS_IRC_CHANNEL(channel) && !channel->server->disconnected &&
-	    !channel->synced)
+	if (IS_IRC_CHANNEL(channel))
 		query_remove_all(channel);
 }
 

src/irc/core/irc-servers.c

@@ -116,11 +116,14 @@ static char **split_line(const SERVER_REC *server, const char *line,
 	 * the code much simpler.  It's worth it.
 	 */
 	len -= strlen(recoded_start) + strlen(recoded_end);
+	g_warn_if_fail(len > 0);
 	if (len <= 0) {
 		/* There is no room for anything. */
 		g_free(recoded_start);
 		g_free(recoded_end);
-		return NULL;
+		lines = g_new(char *, 1);
+		lines[0] = NULL;
+		return lines;
 	}
 
 	lines = recode_split(server, line, target, len, onspace);

src/irc/dcc/dcc-chat.c

@@ -66,6 +66,13 @@ CHAT_DCC_REC *dcc_chat_create(IRC_SERVER_REC *server,
         dcc->id = dcc_chat_get_new_id(nick);
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change init_rec API */
+		g_free(dcc->id);
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -471,6 +478,7 @@ static void cmd_dcc_chat(const char *data, IRC_SERVER_REC *server)
 			/* We are accepting a passive DCC CHAT. */
 			dcc_chat_passive(dcc);
 		}
+		cmd_params_free(free_arg);
 		return;
 	}
 
@@ -485,6 +493,11 @@ static void cmd_dcc_chat(const char *data, IRC_SERVER_REC *server)
 		cmd_param_error(CMDERR_NOT_CONNECTED);
 
 	dcc = dcc_chat_create(server, NULL, nick, "chat");
+	if (dcc == NULL) {
+		cmd_params_free(free_arg);
+		g_warn_if_reached();
+		return;
+	}
 
 	if (g_hash_table_lookup(optlist, "passive") == NULL) {
 		/* Standard DCC CHAT... let's listen for incoming connections */
@@ -627,6 +640,9 @@ static void ctcp_msg_dcc_chat(IRC_SERVER_REC *server, const char *data,
 	}
 	passive = paramcount == 4 && g_strcmp0(params[2], "0") == 0;
 
+	if (nick == NULL)
+		nick = "";
+
 	dcc = DCC_CHAT(dcc_find_request(DCC_CHAT_TYPE, nick, NULL));
 	if (dcc != NULL) {
 		if (dcc_is_listening(dcc)) {
@@ -658,6 +674,11 @@ static void ctcp_msg_dcc_chat(IRC_SERVER_REC *server, const char *data,
 	}
 
 	dcc = dcc_chat_create(server, chat, nick, params[0]);
+	if (dcc == NULL) {
+		g_strfreev(params);
+		g_warn_if_reached();
+		return;
+	}
 	dcc->target = g_strdup(target);
 	dcc->port = atoi(params[2]);
 

src/irc/dcc/dcc-get.c

@@ -43,6 +43,12 @@ GET_DCC_REC *dcc_get_create(IRC_SERVER_REC *server, CHAT_DCC_REC *chat,
 	dcc->fhandle = -1;
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change API */
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -430,9 +436,10 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server, const char *data,
 	int p_id = -1;
 	int passive = FALSE;
 
-	if (addr == NULL) {
+	if (addr == NULL)
 		addr = "";
-	}
+	if (nick == NULL)
+		nick = "";
 
 	/* SEND <file name> <address> <port> <size> [...] */
 	/* SEND <file name> <address> 0 <size> <id> (DCC SEND passive protocol) */
@@ -512,6 +519,12 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server, const char *data,
 		dcc_destroy(DCC(dcc)); /* remove the old DCC */
 
 	dcc = dcc_get_create(server, chat, nick, fname);
+	if (dcc == NULL) {
+		g_free(address);
+		g_free(fname);
+		g_warn_if_reached();
+		return;
+	}
 	dcc->target = g_strdup(target);
 
 	if (passive && port == 0)

src/irc/dcc/dcc-send.c

@@ -237,6 +237,12 @@ static SEND_DCC_REC *dcc_send_create(IRC_SERVER_REC *server,
 	dcc->queue = -1;
 
 	dcc_init_rec(DCC(dcc), server, chat, nick, arg);
+	if (dcc->module_data == NULL) {
+		/* failed to successfully init; TODO: change API */
+		g_free(dcc);
+		return NULL;
+	}
+
         return dcc;
 }
 
@@ -417,6 +423,10 @@ static int dcc_send_one_file(int queue, const char *target, const char *fname,
 
 	dcc = dcc_send_create(server, chat, target, str);
 	g_free(str);
+	if (dcc == NULL) {
+		g_warn_if_reached();
+		return FALSE;
+	}
 
 	dcc->handle = handle;
 	dcc->port = port;