Re: Fwd: report 3/3: latent unterminated buffer in imap_wordcasecmp()

On Thu, Jun 18, 2026 at 02:43:47PM +0200, Alejandro Colomar via Mutt-dev wrote:
> Kevin J. McCarthy wrote:
> > Yes, this was the weird part.  I have no idea.  It's a straight-forward
> > function, so I'm guessing it was just a think-o.  The only caller is looking 
> > at the CAPABILITY list coming from the IMAP server, word by word, and
> > comparing it to the Capability array defined in imap/command.c.

> TBH, it still reads a bit too complex to me.  I struggle to fully
> understand it.

Yes, it's rather weird, and the original version of it seemed a bit
convoluted.

My question is: do we even need to copy the string at all?
It seems to me that this is some variant of strncasecmp(a,b,n)
where n=strlen(a) and the only difference is that if that says
they are equal then we need to check that b[n] is blank or nul.

[Yes it could technically return a different answer if (a) has a
space in it, but that's not an issue.]

Ian Collier.