Fix some ugly bugs in the completion code. In particular,

replace_part() could lead to heap corruption.

diff --git a/enter.c b/enter.c
index fd6236947376c5b2b10219ce6a68e7b5d3b31cae..1b962600fcd959c919d6a5b9e4ef2f1072451f70 100644 (file)
--- a/enter.c
+++ b/enter.c
@@ -116,7 +116,7 @@ static void replace_part (ENTER_STATE *state, size_t from, char *buf)
   if (state->curpos + savelen > state->wbuflen)
   {
     state->wbuflen = state->curpos + savelen;
-    safe_realloc ((void **) state->wbuf, state->wbuflen * sizeof (wchar_t));
+    safe_realloc ((void **) &state->wbuf, state->wbuflen * sizeof (wchar_t));
   }
 
   /* Restore suffix */
@@ -508,9 +508,9 @@ int _mutt_enter_string (char *buf, size_t buflen, int y, int x,
            /* invoke the query-menu to get more addresses */
            if (state->curpos)
            {
-             for (i = state->curpos; i && buf[i - 1] != ','; i--)
+             for (i = state->curpos; i && state->wbuf[i - 1] != ','; i--)
                ;
-             for (; i < state->curpos && buf[i] == ' '; i++)
+             for (; i < state->curpos && state->wbuf[i] == ' '; i++)
                ;
              my_wcstombs (buf, buflen, state->wbuf + i, state->curpos - i);
              mutt_query_complete (buf, buflen);