Fixes to mutt_buffer_expand_path().

Create _mutt_buffer_expand_path() with the rx argument.

Use mutt_b2s() instead of derefencing buffer->data in
mutt_buffer_expand_path().  The p->data uses were safe, but the
src->data was potentially not.

diff --git a/muttlib.c b/muttlib.c
index ee549788bc5d483e14656f292b79550dccbfba18..72ee611ff7c731813315459e2a848867e36d1480 100644 (file)
--- a/muttlib.c
+++ b/muttlib.c
@@ -439,8 +439,8 @@ char *_mutt_expand_path (char *s, size_t slen, int rx)
 
   s_buf = mutt_buffer_pool_get ();
 
-  mutt_buffer_addstr (s_buf, s);
-  mutt_buffer_expand_path (s_buf, rx);
+  mutt_buffer_addstr (s_buf, NONULL (s));
+  _mutt_buffer_expand_path (s_buf, rx);
   strfcpy (s, mutt_b2s (s_buf), slen);
 
   mutt_buffer_pool_release (&s_buf);
@@ -448,7 +448,12 @@ char *_mutt_expand_path (char *s, size_t slen, int rx)
   return s;
 }
 
-void mutt_buffer_expand_path (BUFFER *src, int rx)
+void mutt_buffer_expand_path (BUFFER *src)
+{
+  _mutt_buffer_expand_path (src, 0);
+}
+
+void _mutt_buffer_expand_path (BUFFER *src, int rx)
 {
   BUFFER *p, *q, *tmp;
   const char *s, *tail = "";
@@ -462,7 +467,7 @@ void mutt_buffer_expand_path (BUFFER *src, int rx)
   do
   {
     recurse = 0;
-    s = src->data;
+    s = mutt_b2s (src);
 
     switch (*s)
     {
@@ -543,7 +548,7 @@ void mutt_buffer_expand_path (BUFFER *src, int rx)
          h->env->from = h->env->to = NULL;
          mutt_free_header (&h);
          /* Avoid infinite recursion if the resulting folder starts with '@' */
-         if (*(p->data) != '@')
+         if (*(mutt_b2s (p)) != '@')
            recurse = 1;
 
          tail = "";
@@ -601,7 +606,7 @@ void mutt_buffer_expand_path (BUFFER *src, int rx)
       }
     }
 
-    if (rx && *(p->data) && !recurse)
+    if (rx && *(mutt_b2s (p)) && !recurse)
     {
       mutt_rx_sanitize_string (q, mutt_b2s (p));
       mutt_buffer_printf (tmp, "%s%s", mutt_b2s (q), tail);

diff --git a/protos.h b/protos.h
index 0ea70c80b6310d20e358ea4725673637e35eae72..5601012f5ed3e9e5c0876554b8addecddf3b09ea 100644 (file)
--- a/protos.h
+++ b/protos.h
@@ -138,7 +138,8 @@ const char *mutt_attach_fmt (
 
 char *mutt_charset_hook (const char *);
 char *mutt_iconv_hook (const char *);
-void mutt_buffer_expand_path (BUFFER *, int);
+void mutt_buffer_expand_path (BUFFER *);
+void _mutt_buffer_expand_path (BUFFER *, int);
 char *mutt_expand_path (char *, size_t);
 char *_mutt_expand_path (char *, size_t, int);
 char *mutt_find_hook (int, const char *);