Taint: fix listcount expansion operator. Bug 2586

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 2c29c26d538550801ae7574e597b588860e17fd0..6ed22c14d958a95a80a481f3264b4fd39fbccc4c 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -2066,7 +2066,8 @@ switch (vp->type)
   case vtype_string_func:
     {
     stringptr_fn_t * fn = (stringptr_fn_t *) val;
-    return fn();
+    uschar* s = fn();
+    return s ? s : US"";
     }
 
   case vtype_pspace:
@@ -7207,9 +7208,8 @@ while (*s != 0)
         {
        int cnt = 0;
        int sep = 0;
-       uschar buffer[256];
 
-       while (string_nextinlist(CUSS &sub, &sep, buffer, sizeof(buffer))) cnt++;
+       while (string_nextinlist(CUSS &sub, &sep, NULL, 0)) cnt++;
        yield = string_fmt_append(yield, "%d", cnt);
         continue;
         }