Use strtok_r() to parse mailto: links, not strtok().

In case a headers needs to call mutt_parse_references() which uses
strtok(), too, later headers will be silently discarded. Closes #2968.

diff --git a/ChangeLog b/ChangeLog
index fc86e9b924a0492ec31fcf6d53158b5b57a53b4f..5590fa15113499347a43015c46abb3cc0dba30af 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,25 @@
+2007-11-04 18:14 +0100  Rocco Rutte  <pdmef@gmx.net>  (6248b3c04f61)
+
+       * main.c, url.c: Prevent mailto parsing buffer overflow by ignoring
+       too long header. If they're longer than our buffer, we can't turn it
+       into a header to be parsed by mutt_parse_rfc822_line() anyway, so we
+       bail out in this case. Also make main() catchup mailto parsing
+       errors. Closes #2980.
+
+2007-11-04 17:02 +0100  Rocco Rutte  <pdmef@gmx.net>  (2157b46eb938)
+
+       * UPDATING: Add 1.5.17 to UPDATING
+
+2007-11-04 17:01 +0100  Rocco Rutte  <pdmef@gmx.net>  (1416714ec4d1)
+
+       * doc/manual.xml.head, init.h: Improve DSN docs (require sendmail-
+       compatible MTA, add SMTP notes). Closes #2979
+
+2007-11-03 11:12 +0100  Rocco Rutte  <pdmef@gmx.net>  (0c054faeb285)
+
+       * ChangeLog, muttlib.c: Check Maildir for not being NULL when
+       expanding '='-paths. Closes #2977.
+
 2007-11-02 16:55 -0700  Pawel Dziekonski  <dzieko@pwr.wroc.pl>  (cc5de08f4612)
 
        * po/pl.po: Updated Polish translation.

diff --git a/url.c b/url.c
index b0e6cb3dbfcde847a5b58043b2361878e1a17254..7ee67734cabbb5673cf31ba9131b3f4f35ea2862 100644 (file)
--- a/url.c
+++ b/url.c
@@ -211,7 +211,7 @@ int url_ciss_tostring (ciss_url_t* ciss, char* dest, size_t len, int flags)
 
 int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
 {
-  char *t;
+  char *t, *p;
   char *tmp;
   char *headers;
   char *tag, *value;
@@ -233,9 +233,9 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
   url_pct_decode (tmp);
   e->to = rfc822_parse_adrlist (e->to, tmp);
 
-  tag = headers ? strtok (headers, "&") : NULL;
+  tag = headers ? strtok_r (headers, "&", &p) : NULL;
   
-  for (; tag; tag = strtok (NULL, "&"))
+  for (; tag; tag = strtok_r (NULL, "&", &p))
   {
     if ((value = strchr (tag, '=')))
       *value++ = '\0';