citadel_ipc.c: when fetching an expire policy, the command buffer needs to be

more than 11 bytes, otherwise the string "GPEX mailboxes" smashes the stack.

diff --git a/citadel/citadel_ipc.c b/citadel/citadel_ipc.c
index 04826e36527187104b2edf5059f5530a51746fc6..fe09c67d9fd254de06375e4f0e82affab8cf5c41 100644 (file)
--- a/citadel/citadel_ipc.c
+++ b/citadel/citadel_ipc.c
@@ -1760,7 +1760,7 @@ int CtdlIPCGetMessageExpirationPolicy(CtdlIPC *ipc, int which,
                struct ExpirePolicy **policy, char *cret)
 {
        static char *proto[] = {"room", "floor", "site", "mailboxes" };
-       char aaa[11];
+       char cmd[256];
        register int ret;
 
        if (!cret) return -2;
@@ -1769,14 +1769,13 @@ int CtdlIPCGetMessageExpirationPolicy(CtdlIPC *ipc, int which,
        if (!*policy) return -1;
        if (which < 0 || which > 3) return -2;
        
-       sprintf(aaa, "GPEX %s", proto[which]);
-       ret = CtdlIPCGenericCommand(ipc, aaa, NULL, 0, NULL, NULL, cret);
+       sprintf(cmd, "GPEX %s", proto[which]);
+       ret = CtdlIPCGenericCommand(ipc, cmd, NULL, 0, NULL, NULL, cret);
        if (ret / 100 == 2) {
                policy[0]->expire_mode = extract_int(cret, 0);
                policy[0]->expire_value = extract_int(cret, 1);
        }
        return ret;
-
 }