3 files changed, 15 insertions, 8 deletions

diff --git a/Changes b/Changes
index fa79acd5b..e73c413f8 100644
--- a/Changes
+++ b/Changes
@@ -18,6 +18,7 @@ Provided by Anope Dev. <dev@anope.org> - 2006
 06/11 F Two pointers in modules.c weren't NULL-ified by default.          [ #00]
 06/11 F Updated InspIRCd protocol support module.                         [ #00]
 06/11 F Module Clear Error macro was broken on *BSD.                      [#515]
+06/13 F Walking memory using wrong pointer in moduleGetConfigDirective.   [#516]
 
 Provided by ThaPrince <jon@vile.com> - 2006
 05/19 A Plexus 3 support.                                                 [ #00]
diff --git a/src/modules.c b/src/modules.c
index 3c34f3994..ee9e351b0 100644
--- a/src/modules.c
+++ b/src/modules.c
@@ -2425,6 +2425,7 @@ int moduleGetConfigDirective(Directive * d)
     int linenum = 0;
     int ac = 0;
     char *av[MAXPARAMS];
+	char *str = NULL;
     char *s = NULL;
 	char *t = NULL;
     int retval = 1;
@@ -2440,17 +2441,18 @@ int moduleGetConfigDirective(Directive * d)
             continue;
         dir = myStrGetOnlyToken(buf, '\t', 0);
         if (dir) {
-            s = myStrGetTokenRemainder(buf, '\t', 1);
+            str = myStrGetTokenRemainder(buf, '\t', 1);
         } else {
             dir = myStrGetOnlyToken(buf, ' ', 0);
             if (dir || (dir = myStrGetOnlyToken(buf, '\n', 0))) {
-                s = myStrGetTokenRemainder(buf, ' ', 1);
+                str = myStrGetTokenRemainder(buf, ' ', 1);
             } else {
                 continue;
             }
         }
         if (stricmp(dir, d->name) == 0) {
-            if (s) {
+            if (str) {
+				s = str;
                 while (isspace(*s))
                     s++;
                 while (*s) {
@@ -2484,10 +2486,10 @@ int moduleGetConfigDirective(Directive * d)
             retval = parse_directive(d, dir, ac, av, linenum, 0, s);
         }
     }
-    if (dir)

-    	free(dir);

-    if (s)

-       free(s);
+    if (dir)
+    	free(dir);
+    if (str)
+       free(str);
     fclose(config);
     return retval;
 }
diff --git a/version.log b/version.log
index 5584f9f8c..0308b250b 100644
--- a/version.log
+++ b/version.log
@@ -9,10 +9,14 @@ VERSION_MAJOR="1"
 VERSION_MINOR="7"
 VERSION_PATCH="14"
 VERSION_EXTRA=""
-VERSION_BUILD="1045"
+VERSION_BUILD="1046"
 
 # $Log$
 #
+# BUILD : 1.7.14 (1046)
+# BUGS  : 
+# NOTES : We were walking memory in moduleGetConfigDirecte with an allocated pointer, and free-ing it later when it was past the allocatrd space... We now store the original pointer so we can free it correctly :)
+#
 # BUILD : 1.7.14 (1045)
 # BUGS  : 
 # NOTES : Fixed ano_modclearerr() - it was not POSIX-compliant