+ /* get buffer ready to go */
+ bp = buffer;
+ buflen = sizeof(buffer) - 1;
+ bp[0] = bp[buflen] = '\0';
+ quoted = 0;
+
+ /* Now parse display string */
+ for ( ; *cp && buflen > 0; cp++) {
+ if (*cp == '%') {
+ pp = bp;
+
+ switch (*++cp) {
+ case 'a':
+ /* insert parameters from Content-Type field */
+ {
+ char **ap, **ep;
+ char *s = "";
+
+ for (ap = ci->ci_attrs, ep = ci->ci_values;
+ *ap; ap++, ep++) {
+ snprintf(bp, buflen, "%s%s=\"%s\"",
+ s, *ap, *ep);
+ len = strlen(bp);
+ bp += len;
+ buflen -= len;
+ s = " ";
+ }
+ }
+ break;
+
+ case 'c':
+ /* insert charset */
+ strncpy(bp, ct->c_charset ? ct->c_charset :
+ "US-ASCII", buflen);
+ break;
+
+ case 'd':
+ /* insert content description */
+ if (ct->c_descr) {
+ char *s;
+
+ s = trimcpy(ct->c_descr);
+ strncpy(bp, s, buflen);
+ mh_free0(&s);
+ }
+ break;
+
+ case 'F':
+ /* %f, and stdin is terminal not content */
+ xstdin = 1;
+ /* and fall... */
+
+ case 'f':
+ /* insert filename containing content */
+ snprintf(bp, buflen, "'%s'", file);
+ /*
+ ** since we've quoted the file argument,
+ ** set things up to look past it, to avoid
+ ** problems with the quoting logic below.
+ ** (I know, I should figure out what's
+ ** broken with the quoting logic, but..)
+ */
+ len = strlen(bp);
+ buflen -= len;
+ bp += len;
+ pp = bp;
+ break;
+
+ case 'l':
+ /*
+ ** display listing prior to displaying content
+ */
+ xlist = !nolist;
+ break;
+
+ case 's':
+ /* insert subtype of content */
+ strncpy(bp, ci->ci_subtype, buflen);
+ break;
+
+ case '%':
+ /* insert character % */
+ goto raw;
+
+ default:
+ *bp++ = *--cp;
+ *bp = '\0';
+ buflen--;
+ continue;
+ }
+ len = strlen(bp);
+ bp += len;
+ buflen -= len;
+
+ /* Did we actually insert something? */
+ if (bp != pp) {
+ /*
+ ** Insert single quote if not inside quotes
+ ** already
+ */
+ if (!quoted && buflen) {
+ len = strlen(pp);
+ memmove(pp + 1, pp, len);
+ *pp++ = '\'';
+ buflen--;
+ bp++;
+ }
+ /* Escape existing quotes */
+ while ((pp = strchr(pp, '\'')) && buflen > 3) {
+ len = strlen(pp++);
+ memmove(pp + 3, pp, len);
+ *pp++ = '\\';
+ *pp++ = '\'';
+ *pp++ = '\'';
+ buflen -= 3;
+ bp += 3;
+ }
+ /*
+ ** If pp is still set, that means we ran
+ ** out of space.
+ */
+ if (pp)
+ buflen = 0;
+ if (!quoted && buflen) {
+ *bp++ = '\'';
+ *bp = '\0';
+ buflen--;
+ }
+ }
+ } else {
+raw:
+ *bp++ = *cp;
+ *bp = '\0';
+ buflen--;