Send_Message: Fix handling of "empty" targets

Clients can specify multiple targets for the "PRIVMSG", "NOTICE", and
"SQUERY" commands, separated by commas (e. g. "PRIVMSG a,#b,c :text").

Since commit 49ab79d0 ("Limit the number of message targes, and suppress
duplicates"), ngIRCd crashed when the client sent the separator character
only as target(s), e. g. "," or ",,,," etc.!

This patch fixes the bug and adds a test case for this issue.

Thanks to Florian Westphal <fw@strlen.de> for spotting the issue!

2 files changed, 14 insertions, 1 deletions

diff --git a/src/ngircd/irc.c b/src/ngircd/irc.c
index 15bb90f7..5325b52a 100644
--- a/src/ngircd/irc.c
+++ b/src/ngircd/irc.c
@@ -563,7 +563,9 @@ Send_Message(CLIENT * Client, REQUEST * Req, int ForceType, bool SendErrors)
 	currentTarget = strtok_r(currentTarget, ",", &strtok_last);
 	ngt_UpperStr(Req->command);
 
-	while (true) {
+	/* Please note that "currentTarget" is NULL when the target contains
+	 * the separator character only, e. g. "," or ",,,," etc.! */
+	while (currentTarget) {
 		/* Make sure that there hasn't been such a target already: */
 		targets[target_nr++] = currentTarget;
 		for(i = 0; i < target_nr - 1; i++) {
diff --git a/src/testsuite/message-test.e b/src/testsuite/message-test.e
index e4637863..9eb22e77 100644
--- a/src/testsuite/message-test.e
+++ b/src/testsuite/message-test.e
@@ -38,6 +38,17 @@ expect {
 	"@* PRIVMSG nick :test"
 }
 
+send "privmsg ,,,, :dummy\r"
+send "privmsg ,,,nick,,&server,,, :test\r"
+expect {
+	timeout { exit 1 }
+	"@* PRIVMSG nick :test"
+}
+expect {
+	timeout { exit 1 }
+	"404"
+}
+
 send "privmsg Nick,#testChannel,nick :test\r"
 expect {
 	timeout { exit 1 }