Fix segfault or bus error after bouncing a message. This bug was

introduced into 6.3.0 when removing alloca(); it caused fetchmail to 
free random memory.  Reported by Nathaniel W. Turner, Debian Bug#348747.

svn path=/branches/BRANCH_6-3/; revision=4652

2 files changed, 10 insertions, 2 deletions

diff --git a/NEWS b/NEWS
index 50099bca..934a6273 100644
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,9 @@ fetchmail 6.3.2 (to be released):
 * Add missing --help text for "--sslcertck" option. Matthias Andree.
 * fetchmailconf.py: Accept --help and --version. Matthias Andree.
 * fetchmail --version  now prints the copyright notice. Matthias Andree.
+* Fix segfault or bus error after bouncing a message.  This bug was introduced
+  into 6.3.0 when removing alloca(); it caused fetchmail to free random memory.
+  Reported by Nathaniel W. Turner, Debian Bug#348747. Fix: Matthias Andree.
 
 fetchmail 6.3.1 (released 2005-12-19):
 
diff --git a/sink.c b/sink.c
index 532de189..765240ec 100644
--- a/sink.c
+++ b/sink.c
@@ -984,14 +984,19 @@ transient:
 #ifdef EXPLICIT_BOUNCE_ON_BAD_ADDRESS
     /*
      * This should not be necessary, because the SMTP listener itself
-     * should genrate a bounce for the bad address.
+     * should generate a bounce for the bad address.
+     *
+     * XXX FIXME 2006-01-19: is this comment true? I don't think
+     * it is, because the SMTP listener isn't required to accept bogus
+     * messages. There appears to be general SMTP<->MDA and
+     * responsibility confusion.
      */
     if (*bad_addresses)
 	send_bouncemail(ctl, msg, XMIT_RCPTBAD,
 			"Some addresses were rejected by the MDA fetchmail forwards to.\r\n",
 			*bad_addresses, from_responses);
     while (*bad_addresses)
-	free(from_responses[*--bad_addresses]);
+	free(from_responses[--*bad_addresses]);
     free(from_responses);
 #endif /* EXPLICIT_BOUNCE_ON_BAD_ADDRESS */