diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e4478d7..c5028d47 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,21 @@ # Changelog All notable changes to Ergo will be documented in this file. +## [2.13.1] - 2024-05-06 + +Ergo 2.13.1 is a bugfix release, fixing an exploitable deadlock that could lead to a denial of service. We regret the oversight. + +This release includes no changes to the config file format or database format. + +### Security + +* Fixed an exploitable deadlock that could lead to a denial of service (#2149) + +### Internal + +* Official release builds use Go 1.22.2 + + ## [2.13.0] - 2024-01-14 We're pleased to be publishing v2.13.0, a new stable release. This is a bugfix release that fixes some issues, including a crash. diff --git a/irc/getters.go b/irc/getters.go index baf86cc6..984d3b6c 100644 --- a/irc/getters.go +++ b/irc/getters.go @@ -616,9 +616,11 @@ func (channel *Channel) Founder() string { func (channel *Channel) HighestUserMode(client *Client) (result modes.Mode) { channel.stateMutex.RLock() - clientModes := channel.members[client].modes - channel.stateMutex.RUnlock() - return clientModes.HighestChannelUserMode() + defer channel.stateMutex.RUnlock() + if clientData, ok := channel.members[client]; ok { + return clientData.modes.HighestChannelUserMode() + } + return } func (channel *Channel) Settings() (result ChannelSettings) { diff --git a/irc/version.go b/irc/version.go index 3f74041b..f522ffe4 100644 --- a/irc/version.go +++ b/irc/version.go @@ -7,7 +7,7 @@ import "fmt" const ( // SemVer is the semantic version of Ergo. - SemVer = "2.13.0" + SemVer = "2.13.1" ) var (