Prevent $charset from having multiple values.

Mutt relies on it being a single character set, but failed to make
sure of that in check_charset().

Thanks to Hans-Peter Jansen for reporting the problem, and to Mel
Gorman for working with me to track down the issue in his
configuration.

1 files changed, 14 insertions, 4 deletions

diff --git a/init.c b/init.c
index 2acd885e..1db9a549 100644
--- a/init.c
+++ b/init.c
@@ -1892,6 +1892,18 @@ static int check_charset (struct option_t *opt, const char *val)
   char *p, *q = NULL, *s = safe_strdup (val);
   int rc = 0, strict = strcmp (opt->option, "send_charset") == 0;
 
+  /* $charset should be nonempty, and a single value - not a colon
+   * delimited list */
+  if (mutt_strcmp (opt->option, "charset") == 0)
+  {
+    if (!s || (strchr (s, ':') != NULL))
+    {
+      FREE (&s);
+      return -1;
+    }
+  }
+
+  /* other values can be empty */
   if (!s)
     return rc;
 
@@ -2277,10 +2289,8 @@ static int parse_set (BUFFER *tmp, BUFFER *s, unsigned long data, BUFFER *err)
         }
         else if (DTYPE (MuttVars[idx].type) == DT_STR)
         {
-	  if ((strstr (MuttVars[idx].option, "charset") &&
-	       check_charset (&MuttVars[idx], tmp->data) < 0) |
-	      /* $charset can't be empty, others can */
-	      (strcmp(MuttVars[idx].option, "charset") == 0 && ! *tmp->data))
+	  if (strstr (MuttVars[idx].option, "charset") &&
+              check_charset (&MuttVars[idx], tmp->data) < 0)
 	  {
 	    snprintf (err->data, err->dsize, _("Invalid value for option %s: \"%s\""),
 		      MuttVars[idx].option, tmp->data);