Hi,
https://irssi.org/security/irssi_sa_2017_06.txt
I backported the patch to stable. I don't use irssi so it's not tested.
Cheers,
Daniel
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/irssi/Makefile,v
retrieving revision 1.67
diff -u -p -r1.67 Makefile
--- Makefile 5 Jan 2017 21:37:52 -0000 1.67
+++ Makefile 6 Jun 2017 22:07:18 -0000
@@ -5,6 +5,7 @@ COMMENT = modular IRC client with many f
V = 0.8.21
DISTNAME = irssi-$V
PKGSPEC = irssi-=$V
+REVISION = 0
CATEGORIES = net
Index: patches/patch-src_irc_dcc_dcc-get_c
===================================================================
RCS file: patches/patch-src_irc_dcc_dcc-get_c
diff -N patches/patch-src_irc_dcc_dcc-get_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_irc_dcc_dcc-get_c 6 Jun 2017 22:07:18 -0000
@@ -0,0 +1,23 @@
+$OpenBSD$
+--- src/irc/dcc/dcc-get.c.orig Tue Jun 6 18:03:29 2017
++++ src/irc/dcc/dcc-get.c Tue Jun 6 18:03:00 2017
+@@ -374,6 +374,8 @@ int get_file_params_count(char **params, int paramcoun
+ if (*params[0] == '"') {
+ /* quoted file name? */
+ for (pos = 0; pos < paramcount-3; pos++) {
++ if (strlen(params[pos]) == 0)
++ continue;
+ if (params[pos][strlen(params[pos])-1] == '"' &&
+ get_params_match(params, pos+1))
+ return pos+1;
+@@ -419,6 +421,10 @@ static void ctcp_msg_dcc_send(IRC_SERVER_REC *server,
+ uoff_t size;
+ int p_id = -1;
+ int passive = FALSE;
++
++ if (addr == NULL) {
++ addr = "";
++ }
+
+ /* SEND <file name> <address> <port> <size> [...] */
+ /* SEND <file name> <address> 0 <size> <id> (DCC SEND passive protocol)
*/
Index: patches/patch-src_irc_dcc_dcc-resume_c
===================================================================
RCS file: patches/patch-src_irc_dcc_dcc-resume_c
diff -N patches/patch-src_irc_dcc_dcc-resume_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-src_irc_dcc_dcc-resume_c 6 Jun 2017 22:07:18 -0000
@@ -0,0 +1,12 @@
+$OpenBSD$
+--- src/irc/dcc/dcc-resume.c.orig Tue Jun 6 18:03:50 2017
++++ src/irc/dcc/dcc-resume.c Tue Jun 6 18:03:00 2017
+@@ -62,6 +62,8 @@ int get_file_params_count_resume(char **params, int pa
+ if (*params[0] == '"') {
+ /* quoted file name? */
+ for (pos = 0; pos < paramcount-2; pos++) {
++ if (strlen(params[pos]) == 0)
++ continue;
+ if (params[pos][strlen(params[pos])-1] == '"' &&
+ get_params_match_resume(params, pos+1))
+ return pos+1;
