From: Thomas Roessler <roessler@does-not-exist.org>
Date: Fri, 22 Dec 2000 12:45:31 +0000 (+0000)
Subject: Fix some ugly bugs in the completion code.  In particular,
X-Git-Tag: mutt-1-3-13-rel~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=968efd52bb59b02ec02667cc335208712ef372ed;p=mutt

Fix some ugly bugs in the completion code.  In particular,
replace_part() could lead to heap corruption.
---

diff --git a/enter.c b/enter.c
index fd623694..1b962600 100644
--- a/enter.c
+++ b/enter.c
@@ -116,7 +116,7 @@ static void replace_part (ENTER_STATE *state, size_t from, char *buf)
   if (state->curpos + savelen > state->wbuflen)
   {
     state->wbuflen = state->curpos + savelen;
-    safe_realloc ((void **) state->wbuf, state->wbuflen * sizeof (wchar_t));
+    safe_realloc ((void **) &state->wbuf, state->wbuflen * sizeof (wchar_t));
   }
 
   /* Restore suffix */
@@ -508,9 +508,9 @@ int _mutt_enter_string (char *buf, size_t buflen, int y, int x,
 	    /* invoke the query-menu to get more addresses */
 	    if (state->curpos)
 	    {
-	      for (i = state->curpos; i && buf[i - 1] != ','; i--)
+	      for (i = state->curpos; i && state->wbuf[i - 1] != ','; i--)
 		;
-	      for (; i < state->curpos && buf[i] == ' '; i++)
+	      for (; i < state->curpos && state->wbuf[i] == ' '; i++)
 		;
 	      my_wcstombs (buf, buflen, state->wbuf + i, state->curpos - i);
 	      mutt_query_complete (buf, buflen);