Fixed mutiple possible null-pointer derefences #63

[umurmur.git] / src / messagehandler.c

diff --git a/src/messagehandler.c b/src/messagehandler.c
index f1a753f9e81495764d20f120f9e371ea51959b34..e93afb99ab488ad894dfd45fe8dc3a26f300455b 100644 (file)
--- a/src/messagehandler.c
+++ b/src/messagehandler.c
@@ -285,9 +285,14 @@ void Mh_handle_message(client_t *client, message_t *msg)
                                sendmsg->payload.channelState->n_links = ch_itr->linkcount;
 
                                links = (uint32_t *)malloc(ch_itr->linkcount * sizeof(uint32_t));
+                               if(!links)
+                                       Log_fatal("Out of memory");
+
                                list_iterate(itr, &ch_itr->channel_links) { /* Iterate links */
+                                       channellist_t *chl;
                                        channel_t *ch;
-                                       ch = list_get_entry(itr, channel_t, link_node);
+                                       chl = list_get_entry(itr, channellist_t, node);
+                                       ch = chl->chan;
                                        links[i++] = ch->id;
                                }
                                sendmsg->payload.channelState->links = links;
@@ -878,8 +883,11 @@ void Mh_handle_message(client_t *client, message_t *msg)
                                Log_fatal("Out of memory");
                        memset(sendmsg->payload.userStats->address.data, 0, 16);
                        /* ipv4 representation as ipv6 address. Supposedly correct. */
-                       memcpy(&sendmsg->payload.userStats->address.data[12], &target->remote_tcp.sin_addr, 4);
                        memset(&sendmsg->payload.userStats->address.data[10], 0xff, 2); /* IPv4 */
+      if(target->remote_tcp.ss_family == AF_INET)
+        memcpy(&sendmsg->payload.userStats->address.data[12], &((struct sockaddr_in*)&target->remote_tcp)->sin_addr, 4);
+      else
+        memcpy(&sendmsg->payload.userStats->address.data[0], &((struct sockaddr_in6*)&target->remote_tcp)->sin6_addr, 16);
                        sendmsg->payload.userStats->address.len = 16;
                }
                /* BW */