Fix a segmentation fault. Bug reported by Björn Jacke and analyzed

by Lars Hecking.

diff --git a/sendlib.c b/sendlib.c
index d6093369b0f762d75192ebb2eeccda5e31d3c311..532f40948f0f22fc82c122e3b5e9f3f414529c78 100644 (file)
--- a/sendlib.c
+++ b/sendlib.c
@@ -1650,21 +1650,27 @@ static void encode_headers (LIST *h)
 {
   char *tmp;
   char *p;
-
+  int i;
+  
   for (; h; h = h->next)
   {
-    if ((p = strchr (h->data, ':')))
-    {
-      *p++ = 0;
-      SKIPWS (p);
-      tmp = safe_strdup (p);
-      rfc2047_encode_string (&tmp);
-      safe_realloc ((void **) &h->data, 
-                   strlen (h->data) + 2 + strlen (tmp) + 1);
-      strcat (h->data, ": ");  /* __STRCAT_CHECKED__ */
-      strcat (h->data, tmp);   /* __STRCAT_CHECKED__ */
-      safe_free ((void **) &tmp);
-    }
+    if (!(p = strchr (h->data, ':')))
+      continue;
+
+    i = p - h->data;
+    ++p; SKIPWS (p);
+    tmp = safe_strdup (p);
+
+    if (!tmp)
+      continue;
+    
+    rfc2047_encode_string (&tmp);
+    safe_realloc ((void **) &h->data, 
+                 mutt_strlen (h->data) + 2 + mutt_strlen (tmp) + 1);
+
+    sprintf (h->data + i, ": %s", NONULL (tmp));  /* __SPRINTF_CHECKED__ */
+    
+    safe_free ((void **) &tmp);
   }
 }