Fixed an edge case that could crash the server from a malformed message

[citadel.git] / citadel / msgbase.c

diff --git a/citadel/msgbase.c b/citadel/msgbase.c
index d8015ccae309f3983acb26a1b609157521ecd7aa..284480f80c46af689ba791a628fff30b999f2562 100644 (file)
--- a/citadel/msgbase.c
+++ b/citadel/msgbase.c
@@ -2036,11 +2036,11 @@ int CtdlOutputPreLoadedMsg(
         * using functions that are bounds-checked, and therefore we can
         * make them substantially smaller than SIZ.
         */
-       char suser[100];
-       char luser[100];
-       char fuser[100];
-       char snode[100];
-       char mid[100];
+       char suser[1024];
+       char luser[1024];
+       char fuser[1024];
+       char snode[1024];
+       char mid[1024];
 
        syslog(LOG_DEBUG, "msgbase: CtdlOutputPreLoadedMsg(TheMessage=%s, %d, %d, %d, %d",
                   ((TheMessage == NULL) ? "NULL" : "not null"),
@@ -2143,6 +2143,7 @@ int CtdlOutputPreLoadedMsg(
        strcpy(suser, "");
        strcpy(luser, "");
        strcpy(fuser, "");
+       strcpy(snode, "");
        if (mode == MT_RFC822) 
                OutputRFC822MsgHeaders(
                        TheMessage,
@@ -2872,7 +2873,7 @@ long CtdlSubmitMsg(struct CtdlMessage *msg,       /* message to save */
                if (CC->logged_in) {
                        strcpy(bounce_to, CC->user.fullname);
                }
-               else {
+               else if (!IsEmptyStr(msg->cm_fields[eAuthor])){
                        strcpy(bounce_to, msg->cm_fields[eAuthor]);
                }
                recps->bounce_to = bounce_to;
@@ -2880,20 +2881,17 @@ long CtdlSubmitMsg(struct CtdlMessage *msg,     /* message to save */
                
        CM_SetFieldLONG(msg, eVltMsgNum, newmsgid);
 
-
        /* If this is private, local mail, make a copy in the
         * recipient's mailbox and bump the reference count.
         */
-       if ((recps != NULL) && (recps->num_local > 0))
-       {
+       if ((recps != NULL) && (recps->num_local > 0)) {
                char *pch;
                int ntokens;
 
                pch = recps->recp_local;
                recps->recp_local = recipient;
                ntokens = num_tokens(pch, '|');
-               for (i=0; i<ntokens; ++i)
-               {
+               for (i=0; i<ntokens; ++i) {
                        extract_token(recipient, pch, i, '|', sizeof recipient);
                        syslog(LOG_DEBUG, "msgbase: delivering private local mail to <%s>", recipient);
                        if (CtdlGetUser(&userbuf, recipient) == 0) {
@@ -2929,10 +2927,8 @@ long CtdlSubmitMsg(struct CtdlMessage *msg,      /* message to save */
        }
 
        if (collected_addresses != NULL) {
-               aptr = (struct addresses_to_be_filed *)
-                       malloc(sizeof(struct addresses_to_be_filed));
-               CtdlMailboxName(actual_rm, sizeof actual_rm,
-                               &CC->user, USERCONTACTSROOM);
+               aptr = (struct addresses_to_be_filed *) malloc(sizeof(struct addresses_to_be_filed));
+               CtdlMailboxName(actual_rm, sizeof actual_rm, &CC->user, USERCONTACTSROOM);
                aptr->roomname = strdup(actual_rm);
                aptr->collected_addresses = collected_addresses;
                begin_critical_section(S_ATBF);