By John Goerzen: fix buffer overrun in the text client when sending files with mimet...

[citadel.git] / textclient / src / citadel_ipc.c

diff --git a/textclient/src/citadel_ipc.c b/textclient/src/citadel_ipc.c
index c7e61bc4978ca43ab1c6903f6bd6395b92a3db08..907100db38947053ee01fe1946655a8a33f3017c 100644 (file)
--- a/textclient/src/citadel_ipc.c
+++ b/textclient/src/citadel_ipc.c
@@ -1520,7 +1520,7 @@ int CtdlIPCFileUpload(CtdlIPC *ipc, const char *save_as, const char *comment,
                return -3;
 
        MimeType = GuessMimeType(&MimeTestBuf[0], len);
-       aaa = (char *)malloc(strlen(save_as) + strlen(comment) + 7);
+       aaa = (char *)malloc(strlen(save_as) + strlen(MimeType) + strlen(comment) + 7);
        if (!aaa) return -1;
 
        sprintf(aaa, "UOPN %s|%s|%s", save_as, MimeType,  comment);