From c3b5dae683e25b09abe24b335f2a18717ecb1104 Mon Sep 17 00:00:00 2001
From: Michael Elkins <me@sigpipe.org>
Date: Thu, 12 Aug 2010 16:04:34 -0700
Subject: [PATCH] url_parse_mailto should return 0 on success

fix memory leak errors when unable to parse mailto: URL

closes #3441
---
 url.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/url.c b/url.c
index 389fca88..47228433 100644
--- a/url.c
+++ b/url.c
@@ -249,9 +249,7 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
   char *tmp;
   char *headers;
   char *tag, *value;
-  char scratch[HUGE_STRING];
 
-  size_t taglen;
   int rc = -1;
 
   LIST *last = NULL;
@@ -259,6 +257,7 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
   if (!(t = strchr (src, ':')))
     return -1;
 
+  /* copy string for safe use of strtok() */
   if ((tmp = safe_strdup (t + 1)) == NULL)
     return -1;
 
@@ -266,7 +265,8 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
     *headers++ = '\0';
 
   if (url_pct_decode (tmp) < 0)
-    return -1;
+    goto out;
+
   e->to = rfc822_parse_adrlist (e->to, tmp);
 
   tag = headers ? strtok_r (headers, "&", &p) : NULL;
@@ -279,32 +279,31 @@ int url_parse_mailto (ENVELOPE *e, char **body, const char *src)
       continue;
 
     if (url_pct_decode (tag) < 0)
-      return -1;
+      goto out;
     if (url_pct_decode (value) < 0)
-      return -1;
+      goto out;
 
     if (!ascii_strcasecmp (tag, "body"))
     {
       if (body)
 	mutt_str_replace (body, value);
     }
-    else if ((taglen = mutt_strlen (tag)) <= sizeof (scratch) - 2)
+    else
     {
-      /* only try to parse if we can format it as header for
-       * mutt_parse_rfc822_line (tag fits in scratch) */
-      snprintf (scratch, sizeof (scratch), "%s: %s", tag, value);
-      scratch[taglen] = '\0';
-      value = &scratch[taglen+1];
+      char *scratch;
+     
+      safe_asprintf (&scratch, "%s: %s", tag, value);
+      size_t taglen = mutt_strlen (tag);
+      scratch[taglen] = 0; /* overwrite the colon as mutt_parse_rfc822_line expects */
+      value = &scratch[taglen + 1];
       SKIPWS (value);
       mutt_parse_rfc822_line (e, NULL, scratch, value, 1, 0, 0, &last);
-    }
-    else
-    {
-      rc = -1;
-      goto out;
+      FREE (&scratch);
     }
   }
 
+  rc = 0;
+
 out:
   FREE (&tmp);
   return rc;
-- 
2.40.0