commit d697de31862bc659461498bb5169e7a9bdd525b2
from: Alexander Barton <alex@barton.de>
date: Mon May 25 22:05:22 2020 UTC

IRC_SQUIT(): Fix use-after-free when unregistering the sending client

commit - 02cf31c0e267a4c9a7656d43ad3ad4eeb37fc9c5
commit + d697de31862bc659461498bb5169e7a9bdd525b2
blob - 10f1ef697485886f891dba33eb6a1f9780d90a6c
blob + 3f9753b9670d93205d5d6504e34e9f87e5984cdf
--- src/ngircd/irc-server.c
+++ src/ngircd/irc-server.c
@@ -367,7 +367,7 @@ IRC_SQUIT(CLIENT * Client, REQUEST * Req)
 {
 	char msg[COMMAND_LEN], logmsg[COMMAND_LEN];
 	CLIENT *from, *target;
-	CONN_ID con;
+	CONN_ID con, client_con;
 	int loglevel;
 
 	assert(Client != NULL);
@@ -407,6 +407,7 @@ IRC_SQUIT(CLIENT * Client, REQUEST * Req)
 		return CONNECTED;
 	}
 
+	client_con = Client_Conn(Client);
 	con = Client_Conn(target);
 
 	if (Req->argv[1][0])
@@ -428,7 +429,7 @@ IRC_SQUIT(CLIENT * Client, REQUEST * Req)
 				Req->argv[0], Client_ID(from),
 				Req->argv[1][0] ? Req->argv[1] : "-");
 		Conn_Close(con, NULL, msg, true);
-		if (con == Client_Conn(Client))
+		if (con == client_con)
 			return DISCONNECTED;
 	} else {
 		/* This server is not directly connected, so the SQUIT must