From b8d4f834357a8b5bace808098ce462fa4569b254 Mon Sep 17 00:00:00 2001
From: Kevin McCarthy <kevin@8t8.us>
Date: Mon, 11 Mar 2019 17:04:28 +0800
Subject: [PATCH] Fixes to mutt_buffer_expand_path()

Create _mutt_buffer_expand_path() with the rx argument.

Use mutt_b2s() instead of derefencing buffer->data in
mutt_buffer_expand_path().  The p->data uses were safe, but the
src->data was potentially not.

Co-authored-by: Richard Russon <rich@flatcap.org>
---
 muttlib.c | 25 ++++++++++++++++++-------
 muttlib.h |  3 ++-
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/muttlib.c b/muttlib.c
index 5bc19dfaf..3ff5ea20c 100644
--- a/muttlib.c
+++ b/muttlib.c
@@ -160,13 +160,13 @@ char *mutt_expand_path(char *buf, size_t buflen)
 }
 
 /**
- * mutt_buffer_expand_path - Create the canonical path (with regex char escaping)
+ * mutt_buffer_expand_path_regex - Create the canonical path (with regex char escaping)
  * @param buf     Buffer with path
  * @param regex If true, escape any regex characters
  *
  * @note The path is expanded in-place
  */
-void mutt_buffer_expand_path(struct Buffer *buf, bool regex)
+void mutt_buffer_expand_path_regex(struct Buffer *buf, bool regex)
 {
   const char *s = NULL;
   const char *tail = "";
@@ -180,7 +180,7 @@ void mutt_buffer_expand_path(struct Buffer *buf, bool regex)
   do
   {
     recurse = false;
-    s = buf->data;
+    s = mutt_b2s(buf);
 
     switch (*s)
     {
@@ -264,7 +264,7 @@ void mutt_buffer_expand_path(struct Buffer *buf, bool regex)
           e->env->to = NULL;
           mutt_email_free(&e);
           /* Avoid infinite recursion if the resulting folder starts with '@' */
-          if (*(p->data) != '@')
+          if (*(mutt_b2s(p)) != '@')
             recurse = true;
 
           tail = "";
@@ -322,7 +322,7 @@ void mutt_buffer_expand_path(struct Buffer *buf, bool regex)
       }
     }
 
-    if (regex && *p->data && !recurse)
+    if (regex && *(mutt_b2s(p)) && !recurse)
     {
       mutt_file_sanitize_regex(q, mutt_b2s(p));
       mutt_buffer_printf(tmp, "%s%s", mutt_b2s(q), tail);
@@ -345,6 +345,17 @@ void mutt_buffer_expand_path(struct Buffer *buf, bool regex)
 #endif
 }
 
+/**
+ * mutt_buffer_expand_path - Create the canonical path
+ * @param buf     Buffer with path
+ *
+ * @note The path is expanded in-place
+ */
+void mutt_buffer_expand_path(struct Buffer *buf)
+{
+  mutt_buffer_expand_path_regex(buf, 0);
+}
+
 /**
  * mutt_expand_path_regex - Create the canonical path (with regex char escaping)
  * @param buf     Buffer with path
@@ -358,8 +369,8 @@ char *mutt_expand_path_regex(char *buf, size_t buflen, bool regex)
 {
   struct Buffer *tmp = mutt_buffer_pool_get();
 
-  mutt_buffer_addstr(tmp, buf);
-  mutt_buffer_expand_path(tmp, regex);
+  mutt_buffer_addstr(tmp, NONULL(buf));
+  mutt_buffer_expand_path_regex(tmp, regex);
   mutt_str_strfcpy(buf, mutt_b2s(tmp), buflen);
 
   mutt_buffer_pool_release(&tmp);
diff --git a/muttlib.h b/muttlib.h
index 67b2d9abe..8b7276097 100644
--- a/muttlib.h
+++ b/muttlib.h
@@ -45,7 +45,8 @@ extern struct Regex *C_GecosMask;
 void        mutt_adv_mktemp(char *s, size_t l);
 void        mutt_buffer_adv_mktemp (struct Buffer *buf);
 void        mutt_buffer_mktemp_full(struct Buffer *buf, const char *prefix, const char *suffix, const char *src, int line);
-void        mutt_buffer_expand_path(struct Buffer *buf, bool regex);
+void        mutt_buffer_expand_path(struct Buffer *buf);
+void        mutt_buffer_expand_path_regex(struct Buffer *buf, bool regex);
 int         mutt_check_overwrite(const char *attname, const char *path, char *fname, size_t flen, enum SaveAttach *opt, char **directory);
 void        mutt_encode_path(char *dest, size_t dlen, const char *src);
 void        mutt_expando_format(char *buf, size_t buflen, size_t col, int cols, const char *src, format_t *callback, unsigned long data, MuttFormatFlags flags);
-- 
2.40.0