[bug-mailutils] mailutils question: mime.c

[Shashank Kavishwar]

Hi,

 

In mailuitils-0.4::mime.c line 195,

memmove (e, e + 1, strlen (e) + 2);

 

Why is it memmove by ‘strlen(e) + 2’ ? Shouldn’t it be memmove by ‘strlen(e) + 1’ , i.e the length of ‘e’ and 1 for the ‘\0’ character ?

 

I have a message that has a ‘\’ in the content-type field ‘filename’ and while calling _mime_munge_content_header(), using MALLOC_CHECK_ 2 is giving me illegal memory access and aborting on message_destroy(). The core trace says invalid read on mime.c line 195 (the memmove() call)

 

Thanks,

Shashank