From c6d884e877b3b660cf81b42fef83d5c77e6401b8 Mon Sep 17 00:00:00 2001 From: Aaron Jones Date: Tue, 20 Sep 2016 13:46:33 +0000 Subject: [PATCH] whois: check target is an oper before assuming they have a privset The CHALLENGE functionality will set opername but not privset -- if an oper performs a WHOIS on someone currently half-way through a challenge we will perform a NULL dereference. Related to ircd-seven commit d7b05f7583babf6 --- modules/m_whois.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/m_whois.c b/modules/m_whois.c index a43b9109..d5e33ec6 100644 --- a/modules/m_whois.c +++ b/modules/m_whois.c @@ -320,7 +320,7 @@ single_whois(struct Client *source_p, struct Client *target_p, int operspy) GlobalSetOptions.operstring)); } - if(MyClient(target_p) && !EmptyString(target_p->localClient->opername) && IsOper(source_p)) + if(MyClient(target_p) && !EmptyString(target_p->localClient->opername) && IsOper(target_p) && IsOper(source_p)) { char buf[512]; snprintf(buf, sizeof(buf), "is opered as %s, privset %s",