From 0d8257cbd33919fe0103a7c4b8c2317b5e9cf73d Mon Sep 17 00:00:00 2001
From: Kevin McCarthy <kevin@8t8.us>
Date: Mon, 30 Mar 2020 16:17:03 -0700
Subject: Ensure rc_line err BUFFER is always dynamic.

The mailboxes command changes started using standard mutt_buffer_*()
functions, which will attempt to realloc err->data if the size is too big.
---
 imap/command.c | 13 +++++++------
 imap/imap.c    |  8 ++++----
 2 files changed, 11 insertions(+), 10 deletions(-)

(limited to 'imap')

diff --git a/imap/command.c b/imap/command.c
index cb3f9c0c..d35d7c59 100644
--- a/imap/command.c
+++ b/imap/command.c
@@ -988,7 +988,7 @@ static void cmd_parse_list (IMAP_DATA* idata, char* s)
 static void cmd_parse_lsub (IMAP_DATA* idata, char* s)
 {
   char buf[STRING];
-  char errstr[STRING];
+  char quoted_name[STRING];
   BUFFER err, token;
   ciss_url_t url;
   IMAP_LIST list;
@@ -1017,8 +1017,8 @@ static void cmd_parse_lsub (IMAP_DATA* idata, char* s)
   mutt_account_tourl (&idata->conn->account, &url);
   /* escape \ and ". Also escape ` because the resulting
    * string will be passed to mutt_parse_rc_line. */
-  imap_quote_string_and_backquotes (errstr, sizeof (errstr), list.name);
-  url.path = errstr + 1;
+  imap_quote_string_and_backquotes (quoted_name, sizeof (quoted_name), list.name);
+  url.path = quoted_name + 1;
   url.path[strlen(url.path) - 1] = '\0';
   if (!mutt_strcmp (url.user, ImapUser))
     url.user = NULL;
@@ -1026,11 +1026,12 @@ static void cmd_parse_lsub (IMAP_DATA* idata, char* s)
   safe_strcat (buf, sizeof (buf), "\"");
   mutt_buffer_init (&token);
   mutt_buffer_init (&err);
-  err.data = errstr;
-  err.dsize = sizeof (errstr);
+  err.dsize = STRING;
+  err.data = safe_malloc (err.dsize);
   if (mutt_parse_rc_line (buf, &token, &err))
-    dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", errstr));
+    dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", err.data));
   FREE (&token.data);
+  FREE (&err.data);
 }
 
 /* cmd_parse_myrights: set rights bits according to MYRIGHTS response */
diff --git a/imap/imap.c b/imap/imap.c
index bdd99dff..c1a05e13 100644
--- a/imap/imap.c
+++ b/imap/imap.c
@@ -2092,7 +2092,6 @@ int imap_subscribe (char *path, int subscribe)
   IMAP_DATA *idata;
   char buf[LONG_STRING*2];
   char mbox[LONG_STRING];
-  char errstr[STRING];
   int mblen;
   BUFFER err, token;
   IMAP_MBOX mx;
@@ -2113,15 +2112,16 @@ int imap_subscribe (char *path, int subscribe)
   {
     mutt_buffer_init (&token);
     mutt_buffer_init (&err);
-    err.data = errstr;
-    err.dsize = sizeof (errstr);
+    err.dsize = STRING;
+    err.data = safe_malloc (err.dsize);
     mblen = snprintf (mbox, sizeof (mbox), "%smailboxes ",
                       subscribe ? "" : "un");
     imap_quote_string_and_backquotes (mbox + mblen, sizeof(mbox) - mblen,
                                       path);
     if (mutt_parse_rc_line (mbox, &token, &err))
-      dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", errstr));
+      dprint (1, (debugfile, "Error adding subscribed mailbox: %s\n", err.data));
     FREE (&token.data);
+    FREE (&err.data);
   }
 
   if (subscribe)
-- 
cgit v1.2.3