DoS ircdkit crashes if netcat touches it

[ghost]

An example ircdkit server can be crashed by using netcat.

leet haker

$ netcat localhost 6667
^C
$

servar

~/node_modules/ircdkit/lib/index.js:28
		if (client._socket) throw new Error('Cannot remove a connection with an active socket.');
		                    ^

Error: Cannot remove a connection with an active socket.
    at removeClient (~/node_modules/ircdkit/lib/index.js:28:29)
    at EventEmitter.<anonymous> (~/node_modules/ircdkit/lib/index.js:50:4)
    at emitOne (events.js:116:13)
    at EventEmitter.emit (events.js:211:7)
    at Socket.<anonymous> (~/node_modules/ircdkit/lib/connection.js:77:15)
    at emitNone (events.js:111:20)
    at Socket.emit (events.js:208:7)
    at endReadableNT (_stream_readable.js:1064:12)
    at _combinedTickCallback (internal/process/next_tick.js:138:11)
    at process._tickCallback (internal/process/next_tick.js:180:9)

Is there a way to fix this?

[Twipped]

Oh jeez, I dunno, I haven't looked a this code in 4 years.

[trixiegoff]

this is caused by an unhandled connection 'end' event, fixed by closing the connection before trying to remove it.

[Twipped]

Published 1.0.4 with @cottonflop's fix.

[TestingPlant]

On the advisory for this, it says that there is no fix available while, as far as I know, it was fixed by this pull request. The advisory should be updated to note that it has been fixed in later versions, if possible.

[Twipped]

@TestingPlant I didn't create that advisory, I have no idea how to change it. I don't even see any place on the package info page that shows it exists, let alone how to change it.