* Bug #15213, #18635: The use of the insecure m_scratch() and

[mmh] / uip / mshcmds.c

diff --git a/uip/mshcmds.c b/uip/mshcmds.c
index f2c913c..0201cbc 100644 (file)
--- a/uip/mshcmds.c
+++ b/uip/mshcmds.c
@@ -593,7 +593,7 @@ filehak (char **args)
        if (cwd == NULL)
            cwd = getcpy (pwd ());
        chdir (m_maildir (""));
-       cp = path (cp + 1, *cp == '+' ? TFOLDER : TSUBCWF);
+       cp = pluspath (cp);
        if (access (m_maildir (cp), F_OK) == NOTOK)
            result = OK;
        free (cp);
@@ -703,7 +703,7 @@ foldcmd (char **args)
                return;
            }
            else
-               folder = fmsh ? path (cp + 1, *cp == '+' ? TFOLDER : TSUBCWF)
+               folder = fmsh ? pluspath (cp)
                            : cp + 1;
        }
        else
@@ -867,6 +867,8 @@ forwcmd (char **args)
     int        msgp = 0, vecp = 1, msgnum;
     char *cp, *filter = NULL, buf[BUFSIZ];
     char *msgs[MAXARGS], *vec[MAXARGS];
+    char *tfile = NULL;
+    char tmpfil[BUFSIZ];
 
     if (fmsh) {
        forkcmd (args, cmd_name);
@@ -939,16 +941,12 @@ forwcmd (char **args)
 
                                        /* foil search of .mh_profile */
     snprintf (buf, sizeof(buf), "%sXXXXXX", invo_name);
-/*
-  Mkstemp work postponed until later -Doug
-#ifdef HAVE_MKSTEMP
-    vec[0] = (char *)mkstemp (buf);
-#else
-*/
-    vec[0] = (char *)mktemp (buf);
-/*
-#endif
-*/
+
+    tfile = m_mktemp(buf, NULL, NULL);
+    if (tfile == NULL) adios("forwcmd", "unable to create temporary file");
+    strncpy (tmpfil, tfile, sizeof(tmpfil));
+    vec[0] = tmpfil;
+
     vec[vecp++] = "-file";
     vec[vecp] = NULL;
     if (!msgp)
@@ -979,10 +977,14 @@ static void
 forw (char *proc, char *filter, int vecp, char **vec)
 {
     int i, child_id, msgnum, msgcnt;
-    char tmpfil[80], *args[MAXARGS];
+    char tmpfil[BUFSIZ], *args[MAXARGS];
     FILE *out;
+    char *tfile = NULL;
+
+    tfile = m_mktemp2(NULL, invo_name, NULL, NULL);
+    if (tfile == NULL) adios("forw", "unable to create temporary file");
+    strncpy (tmpfil, tfile, sizeof(tmpfil));
 
-    strncpy (tmpfil, m_tmpfil (invo_name), sizeof(tmpfil));
     interrupted = 0;
     if (filter)
        switch (child_id = fork ()) {
@@ -2547,7 +2549,8 @@ static int
 is_nontext (int msgnum)
 {
     int        result, state;
-    char *bp, *cp, *dp;
+    unsigned char *bp, *dp;
+    char *cp;
     char buf[BUFSIZ], name[NAMESZ];
     FILE *fp;
 
@@ -2960,7 +2963,8 @@ subsort (struct Msg *a, struct Msg *b)
 static char *
 sosmash (char *subj, char *s)
 {
-    register char *cp, *dp, c;
+    register char *cp, *dp;
+    register unsigned char c;
 
     if (s) {
        cp = s;
@@ -2993,8 +2997,9 @@ static int
 process (int msgnum, char *proc, int vecp, char **vec)
 {
     int        child_id, status;
-    char tmpfil[80];
+    char tmpfil[BUFSIZ];
     FILE *out;
+    char *cp;
 
     if (fmsh) {
        strncpy (tmpfil, m_name (msgnum), sizeof(tmpfil));
@@ -3005,23 +3010,20 @@ process (int msgnum, char *proc, int vecp, char **vec)
        goto ready;
     }
 
-    strncpy (tmpfil, m_scratch ("", invo_name), sizeof(tmpfil));
-    if ((out = fopen (tmpfil, "w")) == NULL) {
-       int olderr;
-       char newfil[80];
-
-       olderr = errno;
-       strncpy (newfil, m_tmpfil (invo_name), sizeof(newfil));
-       if ((out = fopen (newfil, "w")) == NULL) {
+    cp = m_mktemp(invo_name, NULL, &out);
+    if (cp == NULL) {
+        /* Try again, but try to create under /tmp */
+       int olderr = errno;
+        cp = m_mktemp2(NULL, invo_name, NULL, &out);
+        if (cp == NULL) {
            errno = olderr;
-           advise (tmpfil, "unable to create temporary file");
+           advise (NULL, "unable to create temporary file");
            return NOTOK;
-       } else {
-           strncpy (tmpfil, newfil, sizeof(tmpfil));
        }
     }
     copy_message (msgnum, out);
     fclose (out);
+    strncpy(tmpfil, cp, sizeof(tmpfil));
 
 ready: ;
     fflush (stdout);
@@ -3087,7 +3089,7 @@ static void
 copy_digest (int msgnum, FILE *out)
 {
     char c;
-    long pos;
+    long pos = 0L;
     static char buffer[BUFSIZ];
     register FILE *zp;