From de825c91520b44e4e2efe6a8f66738e5a5aaec2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Helleu?= <flashcode@flashtux.org>
Date: Sat, 24 Mar 2018 17:10:08 +0100
Subject: [PATCH] irc: check that the modelist item number is valid before
 using it

---
 src/plugins/irc/irc-info.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/plugins/irc/irc-info.c b/src/plugins/irc/irc-info.c
index 9f7b6eb42..1eaab8711 100644
--- a/src/plugins/irc/irc-info.c
+++ b/src/plugins/irc/irc-info.c
@@ -683,8 +683,9 @@ irc_info_infolist_irc_modelist_item_cb (const void *pointer, void *data,
     struct t_irc_channel *ptr_channel;
     struct t_irc_modelist *ptr_modelist;
     struct t_irc_modelist_item *ptr_item;
-    char **argv;
+    char **argv, *error;
     int argc;
+    long number;
 
     /* make C compiler happy */
     (void) pointer;
@@ -722,8 +723,14 @@ irc_info_infolist_irc_modelist_item_cb (const void *pointer, void *data,
         }
         if (!obj_pointer && (argc >= 4))
         {
-            obj_pointer = irc_modelist_item_number (ptr_modelist, atoi(argv[3]));
-
+            error = NULL;
+            number = strtol (argv[3], &error, 10);
+            if (!error || error[0] || (number < 0))
+            {
+                weechat_string_free_split (argv);
+                return NULL;
+            }
+            obj_pointer = irc_modelist_item_number (ptr_modelist, (int)number);
             if (!obj_pointer)
             {
                 weechat_string_free_split (argv);