From 328f86affcaa964750eb1f001345cf6a44e8e150 Mon Sep 17 00:00:00 2001 From: aizu-m Date: Thu, 4 Jun 2026 12:14:33 +0530 Subject: [PATCH] irc: fix out-of-bounds read in DCC command with quoted filename --- CHANGELOG.md | 1 + src/plugins/irc/irc-ctcp.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 721bd36d3..b55c8e7a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,6 +24,7 @@ SPDX-License-Identifier: GPL-3.0-or-later - irc: fix tag in message with list of names when joining a channel - fset: remove error displayed in core buffer when clicking with the mouse below the last option displayed - irc: limit size of data received from the server to prevent memory exhaustion +- irc: fix out-of-bounds read on incoming DCC command with a quoted filename ending the message - relay: limit size of decompressed websocket frame with permessage-deflate to prevent memory exhaustion ([GHSA-v2v4-45wm-5cr3](https://github.com/weechat/weechat/security/advisories/GHSA-v2v4-45wm-5cr3)) - relay: limit size of received websocket frame and HTTP body to prevent memory exhaustion - relay: fix timing attack on password authentication ([GHSA-vhv8-g2r9-cwcc](https://github.com/weechat/weechat/security/advisories/GHSA-vhv8-g2r9-cwcc)) diff --git a/src/plugins/irc/irc-ctcp.c b/src/plugins/irc/irc-ctcp.c index e7b0f8e73..5273f6df0 100644 --- a/src/plugins/irc/irc-ctcp.c +++ b/src/plugins/irc/irc-ctcp.c @@ -857,7 +857,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments) * double-quote */ pos = strrchr (pos_file, '"'); - if (!pos || (pos == pos_file)) + if (!pos || (pos == pos_file) || !pos[1]) { weechat_printf ( ctxt->server->buffer, @@ -1032,7 +1032,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments) * double-quote */ pos = strrchr (pos_file, '"'); - if (!pos || (pos == pos_file)) + if (!pos || (pos == pos_file) || !pos[1]) { weechat_printf ( ctxt->server->buffer, @@ -1176,7 +1176,7 @@ irc_ctcp_recv_dcc (struct t_irc_protocol_ctxt *ctxt, const char *arguments) * double-quote */ pos = strrchr (pos_file, '"'); - if (!pos || (pos == pos_file)) + if (!pos || (pos == pos_file) || !pos[1]) { weechat_printf ( ctxt->server->buffer,