CVE-2020-8955 (published 2020-02-12T22:15Z)

irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malformed IRC message 324 (channel mode).

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/weechat/weechat
commit_details: repo_url: https://github.com/weechat/weechat
author: Sébastien Helleu
author_date: 2020-02-08 20:24:50+01:00
msg: irc: fix crash when receiving a malformed message 324 (channel mode)

Thanks to Stuart Nevans Locke for reporting the issue.
repository: repo_url: https://github.com/weechat/weechat
repo_name: weechat/weechat
description: The extensible chat client.
repo_language: C
owner: weechat
file_changes: filename: ChangeLog.adoc
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,7 @@ Bug fixes::
 
   * core: flush stdout/stderr before forking in hook_process function (issue #1441)
   * core: fix evaluation of condition with nested "if" (issue #1434)
+  * irc: fix crash when receiving a malformed message 324 (channel mode)
   * irc: add nick changes in the hotlist (except self nick change)
   * irc: case-insensitive comparison on incoming CTCP command, force upper case on CTCP replies (issue #1439)
   * irc: fix memory leak when the channel topic is changed

programming_language: Markdown
filename: irc-mode.c
change_type: ModificationType.MODIFY
diff: @@ -224,17 +224,20 @@ irc_mode_channel_update (struct t_irc_server *server,
                     current_arg++;
                 if (pos[0] == chanmode)
                 {
-                    chanmode_found = 1;
-                    if (set_flag == '+')
+                    if (!chanmode_found)
                     {
-                        str_mode[0] = pos[0];
-                        str_mode[1] = '\0';
-                        strcat (new_modes, str_mode);
-                        if (argument)
+                        chanmode_found = 1;
+                        if (set_flag == '+')
                         {
-                            if (new_args[0])
-                                strcat (new_args, " ");
-                            strcat (new_args, argument);
+                            str_mode[0] = pos[0];
+                            str_mode[1] = '\0';
+                            strcat (new_modes, str_mode);
+                            if (argument)
+                            {
+                                if (new_args[0])
+                                    strcat (new_args, " ");
+                                strcat (new_args, argument);
+                            }
                         }
                     }
                 }

programming_language: C