Fix double free in silcd.

[silc.git] / apps / silcd / command.c

diff --git a/apps/silcd/command.c b/apps/silcd/command.c
index c4b0edbef9be85f2b42bc73bf9bde5d954a3d69c..d8d105c535a76a72de9518fe9c1853fe17c48765 100644 (file)
--- a/apps/silcd/command.c
+++ b/apps/silcd/command.c
@@ -1289,7 +1289,7 @@ SILC_SERVER_CMD_FUNC(invite)
 
   /* Send invite list back only if the list was modified, or no arguments
      was given. */
-  type = 0;
+  ttype = 0;
   argc = silc_argument_get_arg_num(cmd->args);
   if (argc == 1)
     ttype = 1;
@@ -1303,7 +1303,7 @@ SILC_SERVER_CMD_FUNC(invite)
                                 2, tmp, len,
                                 3, ttype && list ?
                                 list->data : NULL,
-                                type && list ? silc_buffer_len(list) : 0);
+                                ttype && list ? silc_buffer_len(list) : 0);
   silc_buffer_free(list);
 
  out:
@@ -1472,13 +1472,19 @@ SILC_SERVER_CMD_FUNC(kill)
 
     /* Do normal signoff for the destination client */
     sock = remote_client->connection;
+
+    if (sock)
+      silc_packet_stream_ref(sock);
+
     silc_server_remove_from_channels(server, NULL, remote_client,
                                     TRUE, (char *)"Killed", TRUE, TRUE);
-    silc_server_free_client_data(server, NULL, remote_client, TRUE,
-                                comment ? comment :
-                                (unsigned char *)"Killed");
-    if (sock)
+    silc_server_free_sock_user_data(server, sock, comment ? comment :
+                                   (unsigned char *)"Killed");
+    if (sock) {
+      silc_packet_set_context(sock, NULL);
       silc_server_close_connection(server, sock);
+      silc_packet_stream_unref(sock);
+    }
   } else {
     /* Router operator killing */