commit - d64ab2a36ddbcb8684e37567d8d072752cc3e186
commit + 26c65a11cf06209b2cb5121eda286b5fa8148b89
blob - 2b9a6e85d503e3e83ca51375f9f533078d2920e9
blob + f89ad8e2c3721d9618110bb446f8e6bb6b6328e8
--- ChangeLog
+++ ChangeLog
@@ -9,6 +9,10 @@
 
                                -- ChangeLog --
 
+ngIRCd 0.10.4 (2008-01-07)
+
+  - SECURITY: IRC_PART could reference invalid memory, causing
+    ngircd to crash.
 
 ngIRCd 0.10.3 (2007-07-31)
 
@@ -694,4 +698,4 @@ ngIRCd 0.0.1, 31.12.2001
 
 
 -- 
-$Id: ChangeLog,v 1.302.2.19 2007/07/31 19:33:51 alex Exp $
+$Id: ChangeLog,v 1.302.2.20 2008/01/07 11:41:43 fw Exp $
blob - e59f32fac82b2d70bf8cb8e1d10034395307b562
blob + 99df1dcb0f98da21bbf86f30c87e910454da04d4
--- src/ngircd/irc-channel.c
+++ src/ngircd/irc-channel.c
@@ -14,7 +14,7 @@
 
 #include "portab.h"
 
-static char UNUSED id[] = "$Id: irc-channel.c,v 1.35.2.4 2007/07/31 18:54:30 alex Exp $";
+static char UNUSED id[] = "$Id: irc-channel.c,v 1.35.2.5 2008/01/07 11:41:44 fw Exp $";
 
 #include "imp.h"
 #include <assert.h>
@@ -270,7 +270,9 @@ IRC_PART( CLIENT *Client, REQUEST *Req )
 	assert( Req != NULL );
 
 	/* Falsche Anzahl Parameter? */
-	if(( Req->argc > 2 )) return IRC_WriteStrClient( Client, ERR_NEEDMOREPARAMS_MSG, Client_ID( Client ), Req->command );
+	if (Req->argc < 1 || Req->argc > 2)
+		return IRC_WriteStrClient(Client, ERR_NEEDMOREPARAMS_MSG,
+					Client_ID(Client), Req->command);
 
 	/* Wer ist der Absender? */
 	if( Client_Type( Client ) == CLIENT_SERVER ) target = Client_Search( Req->prefix );