From d30f7e006d2d8ddecb2c7bb1fa147042638be14e Mon Sep 17 00:00:00 2001
From: Bram Matthys <syzop@vulnscan.org>
Date: Mon, 20 Jan 2020 15:41:12 +0100
Subject: [PATCH] Specifying multiple channels ("#one,#two") in set::auto-join,
 set::oper-auto-join or tld::channel was broken. It worked for the very first
 user since boot or rehash, but after that only the first channel was joined.
 Reported by PeGaSuS in https://bugs.unrealircd.org/view.php?id=5535

---
 src/modules/nick.c | 19 ++++++++++++-------
 src/modules/oper.c |  8 +++++---
 2 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/src/modules/nick.c b/src/modules/nick.c
index 1f949c93d..daf1e9d91 100644
--- a/src/modules/nick.c
+++ b/src/modules/nick.c
@@ -1114,24 +1114,29 @@ int _register_user(Client *client, char *nick, char *username, char *umode, char
 		/* Force the user to join the given chans -- codemastr */
 		tlds = find_tld(client);
 
-		if (tlds && !BadPtr(tlds->channel)) {
-			char *chans[3] = {
+		if (tlds && !BadPtr(tlds->channel))
+		{
+			char *chans = strdup(tlds->channel);
+			char *args[3] = {
 				client->name,
-				tlds->channel,
+				chans,
 				NULL
 			};
-			do_cmd(client, NULL, "JOIN", 3, chans);
+			do_cmd(client, NULL, "JOIN", 3, args);
+			safe_free(chans);
 			if (IsDead(client))
 				return 0;
 		}
 		else if (!BadPtr(AUTO_JOIN_CHANS) && strcmp(AUTO_JOIN_CHANS, "0"))
 		{
-			char *chans[3] = {
+			char *chans = strdup(AUTO_JOIN_CHANS);
+			char *args[3] = {
 				client->name,
-				AUTO_JOIN_CHANS,
+				chans,
 				NULL
 			};
-			do_cmd(client, NULL, "JOIN", 3, chans);
+			do_cmd(client, NULL, "JOIN", 3, args);
+			safe_free(chans);
 			if (IsDead(client))
 				return 0;
 		}
diff --git a/src/modules/oper.c b/src/modules/oper.c
index 2500f9009..f9776cf57 100644
--- a/src/modules/oper.c
+++ b/src/modules/oper.c
@@ -299,12 +299,14 @@ CMD_FUNC(cmd_oper)
 
 	if (!BadPtr(OPER_AUTO_JOIN_CHANS) && strcmp(OPER_AUTO_JOIN_CHANS, "0"))
 	{
-		char *chans[3] = {
+		char *chans = strdup(OPER_AUTO_JOIN_CHANS);
+		char *args[3] = {
 			client->name,
-			OPER_AUTO_JOIN_CHANS,
+			chans,
 			NULL
 		};
-		do_cmd(client, NULL, "JOIN", 3, chans);
+		do_cmd(client, NULL, "JOIN", 3, args);
+		safe_free(chans);
 		/* Theoretically the oper may be killed on join. Would be fun, though */
 		if (IsDead(client))
 			return;