584138-mx_update_context-segfault.patch: fix a segfault due to holes in IMAP headers...

[software/mutt-debian.git] / headers.c

diff --git a/headers.c b/headers.c
index cace3a9cfc5bdabfafea7cf82eee1c2c8ff116fb..72ee3eb236c612b07e1b2b1c7e3cde3ae92a4d7e 100644 (file)
--- a/headers.c
+++ b/headers.c
@@ -1,5 +1,5 @@
 /* 
- * Copyright (C) 1996-2000 Michael R. Elkins <me@mutt.org>
+ * Copyright (C) 1996-2009 Michael R. Elkins <me@mutt.org>
  * 
  *     This program is free software; you can redistribute it and/or modify
  *     it under the terms of the GNU General Public License as published by
@@ -44,7 +44,7 @@ void mutt_edit_headers (const char *editor,
   struct stat st;
   LIST *cur, **last = NULL, *tmp;
 
-  mutt_mktemp (path);
+  mutt_mktemp (path, sizeof (path));
   if ((ofp = safe_fopen (path, "w")) == NULL)
   {
     mutt_perror (path);
@@ -64,8 +64,8 @@ void mutt_edit_headers (const char *editor,
 
   mutt_copy_stream (ifp, ofp);
 
-  fclose (ifp);
-  fclose (ofp);
+  safe_fclose (&ifp);
+  safe_fclose (&ofp);
 
   if (stat (path, &st) == -1)
   {
@@ -98,7 +98,7 @@ void mutt_edit_headers (const char *editor,
   if ((ofp = safe_fopen (body, "w")) == NULL)
   {
     /* intentionally leak a possible temporary file here */
-    fclose (ifp);
+    safe_fclose (&ifp);
     mutt_perror (body);
     return;
   }
@@ -106,24 +106,31 @@ void mutt_edit_headers (const char *editor,
   n = mutt_read_rfc822_header (ifp, NULL, 1, 0);
   while ((i = fread (buffer, 1, sizeof (buffer), ifp)) > 0)
     fwrite (buffer, 1, i, ofp);
-  fclose (ofp);
-  fclose (ifp);
+  safe_fclose (&ofp);
+  safe_fclose (&ifp);
   mutt_unlink (path);
 
+  /* in case the user modifies/removes the In-Reply-To header with
+     $edit_headers set, we remove References: as they're likely invalid;
+     we can simply compare strings as we don't generate References for
+     multiple Message-Ids in IRT anyways */
+  if (!n->in_reply_to || (msg->env->in_reply_to &&
+                         mutt_strcmp (n->in_reply_to->data,
+                                      msg->env->in_reply_to->data) != 0))
+    mutt_free_list (&msg->env->references);
+
   /* restore old info. */
+  mutt_free_list (&n->references);
   n->references = msg->env->references;
   msg->env->references = NULL;
 
   mutt_free_envelope (&msg->env);
   msg->env = n; n = NULL;
 
-  if (!msg->env->in_reply_to)
-    mutt_free_list (&msg->env->references);
-
   mutt_expand_aliases_env (msg->env);
 
-  /* search through the user defined headers added to see if either a 
-   * fcc: or attach-file: field was specified.  
+  /* search through the user defined headers added to see if 
+   * fcc: or attach: or pgp: was specified
    */
 
   cur = msg->env->userhdrs;
@@ -132,10 +139,6 @@ void mutt_edit_headers (const char *editor,
   {
     keep = 1;
 
-    /* keep track of whether or not we see the in-reply-to field.  if we did
-     * not, remove the references: field later so that we can generate a new
-     * message based upon this one.
-     */
     if (fcc && ascii_strncasecmp ("fcc:", cur->data, 4) == 0)
     {
       p = cur->data + 4;
@@ -143,7 +146,7 @@ void mutt_edit_headers (const char *editor,
       if (*p)
       {
        strfcpy (fcc, p, fcclen);
-       mutt_pretty_mailbox (fcc);
+       mutt_pretty_mailbox (fcc, fcclen);
       }
       keep = 0;
     }
@@ -151,38 +154,45 @@ void mutt_edit_headers (const char *editor,
     {
       BODY *body;
       BODY *parts;
-      char *q;
+      int l = 0;
 
       p = cur->data + 7;
       SKIPWS (p);
       if (*p)
       {
-       if ((q = strpbrk (p, " \t")))
+       for ( ; *p && *p != ' ' && *p != '\t'; p++)
        {
-         mutt_substrcpy (path, p, q, sizeof (path));
-         SKIPWS (q);
+         if (*p == '\\')
+         {
+           if (!*(p+1))
+             break;
+           p++;
+         }
+         if (l < sizeof (path) - 1)
+           path[l++] = *p;
        }
-       else
-         strfcpy (path, p, sizeof (path));
+       if (*p)
+         *p++ = 0;
+       SKIPWS (p);
+       path[l] = 0;
+
        mutt_expand_path (path, sizeof (path));
        if ((body = mutt_make_file_attach (path)))
        {
-         body->description = safe_strdup (q);
+         body->description = safe_strdup (p);
          for (parts = msg->content; parts->next; parts = parts->next) ;
          parts->next = body;
        }
        else
        {
-         mutt_pretty_mailbox (path);
+         mutt_pretty_mailbox (path, sizeof (path));
          mutt_error (_("%s: unable to attach file"), path);
        }
       }
       keep = 0;
     }
-
-
     else if ((WithCrypto & APPLICATION_PGP)
-             &&ascii_strncasecmp ("pgp:", cur->data, 4) == 0)
+             && ascii_strncasecmp ("pgp:", cur->data, 4) == 0)
     {
       msg->security = mutt_parse_crypt_hdr (cur->data + 4, 0, APPLICATION_PGP);
       if (msg->security)