projects
/
silc.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Fix double free in silcd.
[silc.git]
/
apps
/
silcd
/
command.c
diff --git
a/apps/silcd/command.c
b/apps/silcd/command.c
index c4b0edbef9be85f2b42bc73bf9bde5d954a3d69c..d8d105c535a76a72de9518fe9c1853fe17c48765 100644
(file)
--- a/
apps/silcd/command.c
+++ b/
apps/silcd/command.c
@@
-1289,7
+1289,7
@@
SILC_SERVER_CMD_FUNC(invite)
/* Send invite list back only if the list was modified, or no arguments
was given. */
/* Send invite list back only if the list was modified, or no arguments
was given. */
- type = 0;
+ t
t
ype = 0;
argc = silc_argument_get_arg_num(cmd->args);
if (argc == 1)
ttype = 1;
argc = silc_argument_get_arg_num(cmd->args);
if (argc == 1)
ttype = 1;
@@
-1303,7
+1303,7
@@
SILC_SERVER_CMD_FUNC(invite)
2, tmp, len,
3, ttype && list ?
list->data : NULL,
2, tmp, len,
3, ttype && list ?
list->data : NULL,
- type && list ? silc_buffer_len(list) : 0);
+ t
t
ype && list ? silc_buffer_len(list) : 0);
silc_buffer_free(list);
out:
silc_buffer_free(list);
out:
@@
-1472,13
+1472,19
@@
SILC_SERVER_CMD_FUNC(kill)
/* Do normal signoff for the destination client */
sock = remote_client->connection;
/* Do normal signoff for the destination client */
sock = remote_client->connection;
+
+ if (sock)
+ silc_packet_stream_ref(sock);
+
silc_server_remove_from_channels(server, NULL, remote_client,
TRUE, (char *)"Killed", TRUE, TRUE);
silc_server_remove_from_channels(server, NULL, remote_client,
TRUE, (char *)"Killed", TRUE, TRUE);
- silc_server_free_
client_data(server, NULL, remote_client, TRUE,
- comment ? comment :
- (unsigned char *)"Killed");
- if (sock)
+ silc_server_free_
sock_user_data(server, sock, comment ? comment :
+ (unsigned char *)"Killed");
+ if (sock) {
+ silc_packet_set_context(sock, NULL);
silc_server_close_connection(server, sock);
silc_server_close_connection(server, sock);
+ silc_packet_stream_unref(sock);
+ }
} else {
/* Router operator killing */
} else {
/* Router operator killing */