Taint: fix listcount expansion operator. Bug 2586

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 732e20f972074d80769b63c42af15e2cc8b01318..b01512425e48eeb9d79a2b9a72e0b9c108a1acde 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -2066,7 +2066,8 @@ switch (vp->type)
   case vtype_string_func:
     {
     stringptr_fn_t * fn = (stringptr_fn_t *) val;
-    return fn();
+    uschar* s = fn();
+    return s ? s : US"";
     }
 
   case vtype_pspace:
@@ -6186,11 +6187,12 @@ while (*s != 0)
         case 2:
         case 3: goto EXPAND_FAILED;
         }
-      for (uschar sep = *sub[0], c; c = *sub[1]; sub[1]++)
+      if (*sub[1]) for (uschar sep = *sub[0], c; c = *sub[1]; sub[1]++)
        {
        if (c == sep) yield = string_catn(yield, sub[1], 1);
        yield = string_catn(yield, sub[1], 1);
        }
+      else yield = string_catn(yield, US" ", 1);
       continue;
       }
 
@@ -7206,9 +7208,8 @@ while (*s != 0)
         {
        int cnt = 0;
        int sep = 0;
-       uschar buffer[256];
 
-       while (string_nextinlist(CUSS &sub, &sep, buffer, sizeof(buffer))) cnt++;
+       while (string_nextinlist(CUSS &sub, &sep, NULL, 0)) cnt++;
        yield = string_fmt_append(yield, "%d", cnt);
         continue;
         }