[patch-0.94.6.vikas.complete.1] Fix a completion-related

buffer overflow.

diff --git a/init.c b/init.c
index 32c82b16b469bd3c347ae775ae8a8da57e5f0de7..e4db2bd7e6bf49be4383e09e79bc7481885592ee 100644 (file)
--- a/init.c
+++ b/init.c
@@ -1285,9 +1285,9 @@ int mutt_string_var_complete (char *buffer, size_t len, int pos)
          /* ignore the trailing '=' when comparing */
          strncmp (MuttVars[i].option, pt, strlen (pt) - 1) == 0)
       {
-       strncat (pt, "\"", buffer + len - pt);
-       strncat (pt, NONULL (*((char **) MuttVars[i].data)), buffer + len - pt);
-       strncat (pt, "\"", buffer + len - pt);
+       char tmp [LONG_STRING];
+       strcpy (tmp, pt);
+       snprintf (pt, len, "%s\"%s\"",tmp, NONULL (*((char **) MuttVars[i].data)));
        return 1;
       }
   }