From 57263961b487bd839cbce5fe7547933240792fbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?louiz=E2=80=99?= <louiz@louiz.org>
Date: Thu, 23 Jun 2016 22:14:32 +0200
Subject: Fix a use after free in IrcChannel::remove_user

---
 src/irc/irc_channel.cpp | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

(limited to 'src/irc/irc_channel.cpp')

diff --git a/src/irc/irc_channel.cpp b/src/irc/irc_channel.cpp
index 9801513..e769245 100644
--- a/src/irc/irc_channel.cpp
+++ b/src/irc/irc_channel.cpp
@@ -37,11 +37,14 @@ IrcUser* IrcChannel::find_user(const std::string& name) const
 
 void IrcChannel::remove_user(const IrcUser* user)
 {
-  this->users.erase(std::remove_if(this->users.begin(), this->users.end(),
-                    [user](const std::unique_ptr<IrcUser>& u)
-                    {
-                      return user->nick == u->nick;
-                    }), this->users.end());
+  const auto nick = user->nick;
+  const auto it = std::find_if(this->users.begin(), this->users.end(),
+                               [nick](const std::unique_ptr<IrcUser>& u)
+                               {
+                                 return nick == u->nick;
+                               });
+  if (it != this->users.end())
+    this->users.erase(it);
 }
 
 void IrcChannel::remove_all_users()
-- 
cgit v1.2.3