diff options
author | Thomas Roessler <roessler@does-not-exist.org> | 2000-12-22 12:45:31 +0000 |
---|---|---|
committer | Thomas Roessler <roessler@does-not-exist.org> | 2000-12-22 12:45:31 +0000 |
commit | 968efd52bb59b02ec02667cc335208712ef372ed (patch) | |
tree | 668cc6e9dc612d4c58fdd71e74f619305d68ab4d | |
parent | 6bc3028ea662ad0d5cf1a1d9e8abe897bfa08927 (diff) |
Fix some ugly bugs in the completion code. In particular,
replace_part() could lead to heap corruption.
-rw-r--r-- | enter.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -116,7 +116,7 @@ static void replace_part (ENTER_STATE *state, size_t from, char *buf) if (state->curpos + savelen > state->wbuflen) { state->wbuflen = state->curpos + savelen; - safe_realloc ((void **) state->wbuf, state->wbuflen * sizeof (wchar_t)); + safe_realloc ((void **) &state->wbuf, state->wbuflen * sizeof (wchar_t)); } /* Restore suffix */ @@ -508,9 +508,9 @@ int _mutt_enter_string (char *buf, size_t buflen, int y, int x, /* invoke the query-menu to get more addresses */ if (state->curpos) { - for (i = state->curpos; i && buf[i - 1] != ','; i--) + for (i = state->curpos; i && state->wbuf[i - 1] != ','; i--) ; - for (; i < state->curpos && buf[i] == ' '; i++) + for (; i < state->curpos && state->wbuf[i] == ' '; i++) ; my_wcstombs (buf, buflen, state->wbuf + i, state->curpos - i); mutt_query_complete (buf, buflen); |