Fixed a crash if an expiring channel had the founder also on the access list

2 files changed, 9 insertions, 6 deletions

diff --git a/src/chanserv.cpp b/src/chanserv.cpp
index 06ef6e83c..ef7005667 100644
--- a/src/chanserv.cpp
+++ b/src/chanserv.cpp
@@ -406,15 +406,11 @@ void expire_chans()
 // XXX this is slightly inefficient
 void cs_remove_nick(NickCore *nc)
 {
-	for (registered_channel_map::const_iterator it = RegisteredChannelList.begin(); it != RegisteredChannelList.end();)
+	for (registered_channel_map::const_iterator it = RegisteredChannelList.begin(), it_end = RegisteredChannelList.end(); it != it_end;)
 	{
 		ChannelInfo *ci = it->second;
 		++it;
 
-		ChanAccess *access = ci->GetAccess(nc);
-		if (access)
-			ci->EraseAccess(access);
-
 		for (unsigned j = ci->GetAkickCount(); j > 0; --j)
 		{
 			AutoKick *akick = ci->GetAkick(j - 1);
@@ -468,6 +464,13 @@ void cs_remove_nick(NickCore *nc)
 
 		if (ci->successor == nc)
 			ci->successor = NULL;
+
+		/* Note that it is important we lookup the access for the channel after the new founder
+		 * has been determined incase this user was the founder and also was on the access list!
+		 */
+		ChanAccess *access = ci->GetAccess(nc);
+		if (access)
+			ci->EraseAccess(access);
 	}
 }
 
diff --git a/src/nickserv.cpp b/src/nickserv.cpp
index f5095c53d..396c55c53 100644
--- a/src/nickserv.cpp
+++ b/src/nickserv.cpp
@@ -243,7 +243,7 @@ int validate_user(User *u)
 
 void expire_nicks()
 {
-	for (nickalias_map::const_iterator it = NickAliasList.begin(); it != NickAliasList.end();)
+	for (nickalias_map::const_iterator it = NickAliasList.begin(), it_end = NickAliasList.end(); it != it_end;)
 	{
 		NickAlias *na = it->second;
 		++it;