Fixed park crash bug #63 reported by ViaraiX

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@1312 e03df62e-2008-0410-955e-edbf42e46eb7

3 files changed, 13 insertions, 4 deletions

diff --git a/src/inspircd.cpp b/src/inspircd.cpp
index ecfb5539e..9ee351e08 100644
--- a/src/inspircd.cpp
+++ b/src/inspircd.cpp
@@ -4361,6 +4361,8 @@ int InspIRCd(char** argv, int argc)
 							strlcpy(sanitized,single_line.c_str(),MAXBUF);
 							if (*sanitized)
 							{
+								log(DEBUG,"ref in: %lu",fd_ref_table[currfd]);
+								userrec* old_comp = fd_ref_table[currfd];
 								// we're gonna re-scan to check if the nick is gone, after every
 								// command - if it has, we're gonna bail
 								process_buffer(sanitized,current);
@@ -4368,7 +4370,11 @@ int InspIRCd(char** argv, int argc)
 								// we cant do anything more with their buffer, so bail.
 								// there used to be an ugly, slow loop here. Now we have a reference
 								// table, life is much easier (and FASTER)
-								if (!fd_ref_table[currfd])
+								userrec* new_comp = fd_ref_table[currfd];
+								log(DEBUG,"ref out: %lu",fd_ref_table[currfd]);
+								if (old_comp != new_comp)
+									log(DEBUG,"Bailing, old_comp != new_comp");
+								if ((currfd < 0) || (!fd_ref_table[currfd]) || (old_comp != new_comp))
 									goto label;
 
 							}
diff --git a/src/modules.cpp b/src/modules.cpp
index e32701e67..5b8d0d505 100644
--- a/src/modules.cpp
+++ b/src/modules.cpp
@@ -672,17 +672,20 @@ bool Server::UserToPseudo(userrec* user,std::string message)
 {
 	unsigned int old_fd = user->fd;
 	user->fd = FD_MAGIC_NUMBER;
+	user->ClearBuffer();
 	Write(old_fd,"ERROR :Closing link (%s@%s) [%s]",user->ident,user->host,message.c_str());
+	shutdown(old_fd,2);
 	close(old_fd);
-	shutdown (old_fd,2);
 }
 
 bool Server::PseudoToUser(userrec* alive,userrec* zombie,std::string message)
 {
 	zombie->fd = alive->fd;
 	alive->fd = FD_MAGIC_NUMBER;
+	alive->ClearBuffer();
 	Write(zombie->fd,":%s!%s@%s NICK %s",alive->nick,alive->ident,alive->host,zombie->nick);
 	kill_link(alive,message.c_str());
+	fd_ref_table[zombie->fd] = zombie;
         for (int i = 0; i != MAXCHANS; i++)
         {
                 if (zombie->chans[i].channel != NULL)
@@ -698,8 +701,6 @@ bool Server::PseudoToUser(userrec* alive,userrec* zombie,std::string message)
                         	}
                         	userlist(zombie,Ptr);
                         	WriteServ(zombie->fd,"366 %s %s :End of /NAMES list.", zombie->nick, Ptr->name);
-                        	//WriteServ(zombie->fd,"324 %s %s +%s",zombie->nick, Ptr->name,chanmodes(Ptr));
-                        	//WriteServ(zombie->fd,"329 %s %s %d", zombie->nick, Ptr->name, Ptr->created);
 
                         }
                 }
diff --git a/src/users.cpp b/src/users.cpp
index 7348c6db3..73e0019aa 100644
--- a/src/users.cpp
+++ b/src/users.cpp
@@ -202,6 +202,8 @@ void userrec::ClearBuffer()
 
 std::string userrec::GetBuffer()
 {
+	if (recvq == "")
+		return "";
         char* line = (char*)recvq.c_str();
         std::string ret = "";
         while ((*line != '\n') && (strlen(line)))