From a22eb6f832e0c0a17eb879e1d8472cb5b9dd551d Mon Sep 17 00:00:00 2001
From: Art Cancro <ajc@citadel.org>
Date: Thu, 1 May 2003 15:33:05 +0000
Subject: [PATCH] * Fixed a potential memory leak in enumeration of MIME parts

---
 webcit/ChangeLog  |  4 ++++
 webcit/messages.c | 28 +++++++---------------------
 2 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/webcit/ChangeLog b/webcit/ChangeLog
index db530d664..047ae669a 100644
--- a/webcit/ChangeLog
+++ b/webcit/ChangeLog
@@ -1,4 +1,7 @@
 $Log$
+Revision 410.17  2003/05/01 15:33:05  ajc
+* Fixed a potential memory leak in enumeration of MIME parts
+
 Revision 410.16  2003/05/01 03:11:35  ajc
 * When static content is requested, fetch it without trying to connect
   to Citadel first.
@@ -1352,3 +1355,4 @@ Sun Dec  6 19:50:55 EST 1998 Art Cancro <ajc@uncnsrd.mt-kisco.ny.us>
 
 1998-12-03 Nathan Bryant <bryant@cs.usm.maine.edu>
 	* webserver.c: warning fix
+
diff --git a/webcit/messages.c b/webcit/messages.c
index 049bc9a3e..4bd8b0940 100644
--- a/webcit/messages.c
+++ b/webcit/messages.c
@@ -205,7 +205,7 @@ void read_message(long msgnum) {
 	char mime_content_type[SIZ];
 	char mime_disposition[SIZ];
 	int mime_length;
-	char *mime_http = NULL;
+	char mime_http[SIZ];
 	char m_subject[SIZ];
 	char from[SIZ];
 	char node[SIZ];
@@ -225,6 +225,7 @@ void read_message(long msgnum) {
 	strcpy(reply_to, "");
 	strcpy(vcard_partnum, "");
 	strcpy(cal_partnum, "");
+	strcpy(mime_http, "");
 
 	serv_printf("MSG4 %ld", msgnum);
 	serv_gets(buf);
@@ -299,15 +300,8 @@ void read_message(long msgnum) {
 			mime_length = extract_int(&buf[5], 5);
 
 			if (!strcasecmp(mime_disposition, "attachment")) {
-				if (mime_http == NULL) {
-					mime_http = malloc(512);
-					strcpy(mime_http, "");
-				}
-				else {
-					mime_http = realloc(mime_http,
-						strlen(mime_http) + 512);
-				}
-				sprintf(&mime_http[strlen(mime_http)],
+				snprintf(&mime_http[strlen(mime_http)],
+					(sizeof(mime_http) - strlen(mime_http) - 1),
 					"<A HREF=\"/output_mimepart?"
 					"msgnum=%ld&partnum=%s\" "
 					"TARGET=\"wc.%ld.%s\">"
@@ -322,15 +316,8 @@ void read_message(long msgnum) {
 
 			if ((!strcasecmp(mime_disposition, "inline"))
 			   && (!strncasecmp(mime_content_type, "image/", 6)) ){
-				if (mime_http == NULL) {
-					mime_http = malloc(512);
-					strcpy(mime_http, "");
-				}
-				else {
-					mime_http = realloc(mime_http,
-						strlen(mime_http) + 512);
-				}
-				sprintf(&mime_http[strlen(mime_http)],
+				snprintf(&mime_http[strlen(mime_http)],
+					(sizeof(mime_http) - strlen(mime_http) - 1),
 					"<IMG SRC=\"/output_mimepart?"
 					"msgnum=%ld&partnum=%s\">",
 					msgnum, mime_partnum);
@@ -471,9 +458,8 @@ void read_message(long msgnum) {
 
 
 	/* Afterwards, offer links to download attachments 'n' such */
-	if (mime_http != NULL) {
+	if (strlen(mime_http) > 0) {
 		wprintf("%s", mime_http);
-		free(mime_http);
 	}
 
 	/* Handler for vCard parts */
-- 
2.39.2