Index: modules/mod_facts.c
===================================================================
RCS file: /cvsroot/proftp/proftpd/modules/mod_facts.c,v
retrieving revision 1.45
diff -u -r1.45 mod_facts.c
--- modules/mod_facts.c	23 May 2011 21:11:56 -0000	1.45
+++ modules/mod_facts.c	17 Jan 2012 00:26:59 -0000
@@ -1034,11 +1034,12 @@
   c = find_config(get_dir_ctxt(cmd->tmp_pool, (char *) best_path), CONF_PARAM,
     "DirFakeUser", FALSE);
   if (c) {
-    const char *fake_user = NULL;
-
     if (c->argc > 0) {
+      const char *fake_user = NULL;
+
       fake_user = c->argv[0];
-      if (strncmp(fake_user, "~", 2) != 0) {
+      if (fake_user != NULL &&
+          strncmp(fake_user, "~", 2) != 0) {
         fake_uid = pr_auth_name2uid(cmd->tmp_pool, fake_user);
 
       } else {
@@ -1054,11 +1055,12 @@
   c = find_config(get_dir_ctxt(cmd->tmp_pool, (char *) best_path), CONF_PARAM,
     "DirFakeGroup", FALSE);
   if (c) {
-    const char *fake_group = NULL;
-
     if (c->argc > 0) {
+      const char *fake_group = NULL;
+
       fake_group = c->argv[0];
-      if (strncmp(fake_group, "~", 2) != 0) {
+      if (fake_group != NULL &&
+          strncmp(fake_group, "~", 2) != 0) {
         fake_gid = pr_auth_name2gid(cmd->tmp_pool, fake_group);
 
       } else {
@@ -1213,13 +1215,20 @@
   c = find_config(get_dir_ctxt(cmd->tmp_pool, (char *) decoded_path),
     CONF_PARAM, "DirFakeUser", FALSE);
   if (c) {
-    const char *fake_user;
+    if (c->argc > 0) {
+      const char *fake_user;
 
-    fake_user = c->argv[0];
-    if (strncmp(fake_user, "~", 2) != 0) {
-      fake_uid = pr_auth_name2uid(cmd->tmp_pool, fake_user);
+      fake_user = c->argv[0];
+      if (fake_user != NULL &&
+          strncmp(fake_user, "~", 2) != 0) {
+        fake_uid = pr_auth_name2uid(cmd->tmp_pool, fake_user);
+
+      } else {
+        fake_uid = session.uid;
+      }
 
     } else {
+      /* Handle the "DirFakeUser off" case (Bug#3715). */
       fake_uid = session.uid;
     }
   }
@@ -1227,13 +1236,20 @@
   c = find_config(get_dir_ctxt(cmd->tmp_pool, (char *) decoded_path),
     CONF_PARAM, "DirFakeGroup", FALSE);
   if (c) {
-    const char *fake_group;
+    if (c->argc > 0) {
+      const char *fake_group;
+
+      fake_group = c->argv[0];
+      if (fake_group != NULL &&
+          strncmp(fake_group, "~", 2) != 0) {
+        fake_gid = pr_auth_name2gid(cmd->tmp_pool, fake_group);
 
-    fake_group = c->argv[0];
-    if (strncmp(fake_group, "~", 2) != 0) {
-      fake_gid = pr_auth_name2gid(cmd->tmp_pool, fake_group);
+      } else {
+        fake_gid = session.gid;
+      }
 
     } else {
+      /* Handle the "DirFakeGroup off" case (Bug#3715). */
       fake_gid = session.gid;
     }
   }