From 3894aeba970cae94a532dd163f4dd70dee42d265 Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Tue, 14 Jul 2020 19:25:07 +0200
Subject: [PATCH] Fix double batch on HISTORY #channel. Reported by k4be in
 https://bugs.unrealircd.org/view.php?id=5709

---
 src/modules/labeled-response.c | 39 ++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 11 deletions(-)

diff --git a/src/modules/labeled-response.c b/src/modules/labeled-response.c
index e070bb3df..56e9183dd 100644
--- a/src/modules/labeled-response.c
+++ b/src/modules/labeled-response.c
@@ -277,17 +277,34 @@ int lr_packet(Client *from, Client *to, Client *intended_to, char **msg, int *le
 				char *batchstr = gen_start_batch();
 				int more_tags_one = currentcmd.firstbuf[0] == '@';
 				int more_tags_two = **msg == '@';
-				snprintf(packet, sizeof(packet),
-				         "%s\r\n"
-				         "@batch=%s%s%s\r\n"
-				         "@batch=%s%s%s",
-				         batchstr,
-				         currentcmd.batch,
-				         more_tags_one ? ";" : " ",
-				         more_tags_one ? currentcmd.firstbuf+1 : currentcmd.firstbuf,
-				         currentcmd.batch,
-				         more_tags_two ? ";" : " ",
-				         more_tags_two ? *msg+1 : *msg);
+
+				if (!strncmp(*msg, "@batch", 6))
+				{
+					/* Special case: current message (*msg) already contains a batch */
+					snprintf(packet, sizeof(packet),
+						 "%s\r\n"
+						 "@batch=%s%s%s\r\n"
+						 "%s",
+						 batchstr,
+						 currentcmd.batch,
+						 more_tags_one ? ";" : " ",
+						 more_tags_one ? currentcmd.firstbuf+1 : currentcmd.firstbuf,
+						 *msg);
+				} else
+				{
+					/* Regular case: current message (*msg) contains no batch yet, add one.. */
+					snprintf(packet, sizeof(packet),
+						 "%s\r\n"
+						 "@batch=%s%s%s\r\n"
+						 "@batch=%s%s%s",
+						 batchstr,
+						 currentcmd.batch,
+						 more_tags_one ? ";" : " ",
+						 more_tags_one ? currentcmd.firstbuf+1 : currentcmd.firstbuf,
+						 currentcmd.batch,
+						 more_tags_two ? ";" : " ",
+						 more_tags_two ? *msg+1 : *msg);
+				}
 				*msg = packet;
 				*len = strlen(*msg);
 			} else {