Fix seqset iterator when it ends in a comma.

If the seqset ended with a comma, the substr_end marker would be just
before the trailing nul.  In the next call, the loop to skip the
marker would iterate right past the end of string too.

The fix is simple: place the substr_end marker and skip past it
immediately.

1 files changed, 1 insertions, 3 deletions

diff --git a/imap/util.c b/imap/util.c
index c529fd8f..488e8396 100644
--- a/imap/util.c
+++ b/imap/util.c
@@ -1036,13 +1036,11 @@ int mutt_seqset_iterator_next (SEQSET_ITERATOR *iter, unsigned int *next)
     if (iter->substr_cur == iter->eostr)
       return 1;
 
-    while (!*(iter->substr_cur))
-      iter->substr_cur++;
     iter->substr_end = strchr (iter->substr_cur, ',');
     if (!iter->substr_end)
       iter->substr_end = iter->eostr;
     else
-      *(iter->substr_end) = '\0';
+      *(iter->substr_end++) = '\0';
 
     range_sep = strchr (iter->substr_cur, ':');
     if (range_sep)