Fix double free in silcd.

[silc.git] / apps / silcd / server_util.c

diff --git a/apps/silcd/server_util.c b/apps/silcd/server_util.c
index 345419a25a9568bf6b77a87f4afdbc1e017ce963..74ce18ba2902866107148517f3f961fe645dd714 100644 (file)
--- a/apps/silcd/server_util.c
+++ b/apps/silcd/server_util.c
@@ -228,6 +228,8 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
        client->mode = 0;
        client->router = NULL;
        client->connection = NULL;
+       client->data.created = silc_time();
+       silc_dlist_del(server->expired_clients, client);
        silc_dlist_add(server->expired_clients, client);
       } else {
        silc_idlist_del_data(client);
@@ -289,6 +291,8 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
        client->mode = 0;
        client->router = NULL;
        client->connection = NULL;
+       client->data.created = silc_time();
+       silc_dlist_del(server->expired_clients, client);
        silc_dlist_add(server->expired_clients, client);
       } else {
        silc_idlist_del_data(client);
@@ -1195,6 +1199,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "You support too old protocol version");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
 
@@ -1206,6 +1211,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "You support too old software version");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
 
@@ -1217,6 +1223,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "Your software is not supported");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
   }
@@ -1236,6 +1243,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
     silc_server_disconnect_remote(server, sock,
                                  SILC_STATUS_ERR_RESOURCE_LIMIT,
                                  "Server is full, try again later");
+    silc_server_free_sock_user_data(server, sock, NULL);
     return FALSE;
   }
 
@@ -1247,6 +1255,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
     silc_server_disconnect_remote(server, sock,
                                  SILC_STATUS_ERR_RESOURCE_LIMIT,
                                  "Too many connections from your host");
+    silc_server_free_sock_user_data(server, sock, NULL);
     return FALSE;
   }
 
@@ -1538,8 +1547,17 @@ void silc_server_kill_client(SilcServer server,
   if (remote_client->connection) {
     /* Remove locally conneted client */
     SilcPacketStream sock = remote_client->connection;
-    silc_server_free_client_data(server, sock, remote_client, FALSE, NULL);
-    silc_server_close_connection(server, sock);
+
+    if (sock)
+      silc_packet_stream_ref(sock);
+
+    silc_server_free_sock_user_data(server, sock, NULL);
+
+    if (sock) {
+      silc_packet_set_context(sock, NULL);
+      silc_server_close_connection(server, sock);
+      silc_packet_stream_unref(sock);
+    }
   } else {
     /* Update statistics */
     server->stat.clients--;
@@ -1561,6 +1579,7 @@ void silc_server_kill_client(SilcServer server,
     }
 
     /* Remove remote client */
+    silc_dlist_del(server->expired_clients, remote_client);
     silc_idlist_del_data(remote_client);
     if (!silc_idlist_del_client(server->global_list, remote_client)) {
       /* Remove this client from watcher list if it is */
@@ -1753,10 +1772,11 @@ SilcBool silc_server_inviteban_match(SilcServer server, SilcHashTable list,
                                     SilcUInt8 type, void *check)
 {
   unsigned char *tmp = NULL;
-  SilcUInt32 len = 0, t;
+  SilcUInt32 len = 0;
   SilcHashTableList htl;
   SilcBuffer entry, idp = NULL, pkp = NULL;
   SilcBool ret = FALSE;
+  void *t;
 
   SILC_LOG_DEBUG(("Matching invite/ban"));
 
@@ -1786,13 +1806,14 @@ SilcBool silc_server_inviteban_match(SilcServer server, SilcHashTable list,
   /* Compare the list */
   silc_hash_table_list(list, &htl);
   while (silc_hash_table_get(&htl, (void *)&t, (void *)&entry)) {
-    if (type == t) {
+    if (type == SILC_PTR_TO_32(t)) {
       if (type == 1) {
        if (silc_string_match(entry->data, tmp)) {
          ret = TRUE;
          break;
        }
-      } else if (!memcmp(entry->data, tmp, len)) {
+      } else if (silc_buffer_len(entry) == len &&
+                !memcmp(entry->data, tmp, len)) {
        ret = TRUE;
        break;
       }
@@ -1816,6 +1837,7 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 {
   unsigned char *tmp;
   SilcUInt32 type, len;
+  void *ptype;
   SilcBuffer tmp2;
   SilcHashTableList htl;
 
@@ -1842,8 +1864,9 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Check if the string is added already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 1 && silc_string_match(tmp2->data, tmp)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 1 &&
+             silc_string_match(tmp2->data, tmp)) {
            tmp = NULL;
            break;
          }
@@ -1873,8 +1896,8 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Check if the public key is in the list already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 2 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 2 && !memcmp(tmp2->data, tmp, len)) {
            tmp = NULL;
            break;
          }
@@ -1893,8 +1916,8 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Check if the ID is in the list already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 3 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 3 && !memcmp(tmp2->data, tmp, len)) {
            tmp = NULL;
            break;
          }
@@ -1932,8 +1955,9 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Delete from the list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 1 && silc_string_match(tmp2->data, tmp)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 1 &&
+             silc_string_match(tmp2->data, tmp)) {
            silc_hash_table_del_by_context(list, (void *)1, tmp2);
            break;
          }
@@ -1953,8 +1977,8 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Delete from the invite list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 2 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 2 && !memcmp(tmp2->data, tmp, len)) {
            silc_hash_table_del_by_context(list, (void *)2, tmp2);
            break;
          }
@@ -1966,8 +1990,8 @@ SilcBool silc_server_inviteban_process(SilcServer server,
 
        /* Delete from the invite list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 3 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 3 && !memcmp(tmp2->data, tmp, len)) {
            silc_hash_table_del_by_context(list, (void *)3, tmp2);
            break;
          }
@@ -2097,6 +2121,8 @@ SilcBuffer silc_server_get_channel_pk_list(SilcServer server,
   silc_hash_table_list(channel->channel_pubkeys, &htl);
   while (silc_hash_table_get(&htl, NULL, (void *)&pk)) {
     pkp = silc_public_key_payload_encode(pk);
+    if (!pkp)
+      continue;
     list = silc_argument_payload_encode_one(list, pkp->data,
                                            silc_buffer_len(pkp),
                                            announce ? 0x03 :