Hi, https://irssi.org/security/irssi_sa_2017_06.txt
I backported the patch to stable. I don't use irssi so it's not tested. Cheers, Daniel Index: Makefile =================================================================== RCS file: /cvs/ports/net/irssi/Makefile,v retrieving revision 1.67 diff -u -p -r1.67 Makefile --- Makefile 5 Jan 2017 21:37:52 -0000 1.67 +++ Makefile 6 Jun 2017 22:07:18 -0000 @@ -5,6 +5,7 @@ COMMENT = modular IRC client with many f V = 0.8.21 DISTNAME = irssi-$V PKGSPEC = irssi-=$V +REVISION = 0 CATEGORIES = net Index: patches/patch-src_irc_dcc_dcc-get_c =================================================================== RCS file: patches/patch-src_irc_dcc_dcc-get_c diff -N patches/patch-src_irc_dcc_dcc-get_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-src_irc_dcc_dcc-get_c 6 Jun 2017 22:07:18 -0000 @@ -0,0 +1,23 @@ +$OpenBSD$ +--- src/irc/dcc/dcc-get.c.orig Tue Jun 6 18:03:29 2017 ++++ src/irc/dcc/dcc-get.c Tue Jun 6 18:03:00 2017 +@@ -374,6 +374,8 @@ int get_file_params_count(char **params, int paramcoun + if (*params[0] == '"') { + /* quoted file name? */ + for (pos = 0; pos < paramcount-3; pos++) { ++ if (strlen(params[pos]) == 0) ++ continue; + if (params[pos][strlen(params[pos])-1] == '"' && + get_params_match(params, pos+1)) + return pos+1; +@@ -419,6 +421,10 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server, + uoff_t size; + int p_id = -1; + int passive = FALSE; ++ ++ if (addr == NULL) { ++ addr = ""; ++ } + + /* SEND <file name> <address> <port> <size> [...] */ + /* SEND <file name> <address> 0 <size> <id> (DCC SEND passive protocol) */ Index: patches/patch-src_irc_dcc_dcc-resume_c =================================================================== RCS file: patches/patch-src_irc_dcc_dcc-resume_c diff -N patches/patch-src_irc_dcc_dcc-resume_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-src_irc_dcc_dcc-resume_c 6 Jun 2017 22:07:18 -0000 @@ -0,0 +1,12 @@ +$OpenBSD$ +--- src/irc/dcc/dcc-resume.c.orig Tue Jun 6 18:03:50 2017 ++++ src/irc/dcc/dcc-resume.c Tue Jun 6 18:03:00 2017 +@@ -62,6 +62,8 @@ int get_file_params_count_resume(char **params, int pa + if (*params[0] == '"') { + /* quoted file name? */ + for (pos = 0; pos < paramcount-2; pos++) { ++ if (strlen(params[pos]) == 0) ++ continue; + if (params[pos][strlen(params[pos])-1] == '"' && + get_params_match_resume(params, pos+1)) + return pos+1;