From 1961c60c10d4c4a722c1ae295c44cd930f722b67 Mon Sep 17 00:00:00 2001
From: Willy Tarreau <w@1wt.eu>
Date: Thu, 23 Jan 2014 22:30:34 +0100
Subject: BUG: segfault if To or Cc contains an odd number of quotes

do { toline++ } while (*toline != '"')...
---
 original.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/original.c b/original.c
index 2086e7d..4aa0c0f 100644
--- a/original.c
+++ b/original.c
@@ -290,7 +290,7 @@ string_t *parse_mail(string_t *buffer, int *total_rcpts)
 			toline+=strlen(headers[cur_header]);
 		}
 		
-		for(; toline && cur_rcpt<MAX_RCPTS; toline++)
+		for(; toline && *toline && cur_rcpt<MAX_RCPTS; toline++)
 		{
 			if (*toline=='\n' && *(toline-1)!=',' && *(toline-1)!=';' && *(toline-1)!=' ' && *(toline+1)!='\t')
 			{
@@ -334,6 +334,10 @@ string_t *parse_mail(string_t *buffer, int *total_rcpts)
 				case '"':
 					do {
 						toline++;
+						if (!*toline) {
+							log_msg(LOG_WARNING,"One address contains an unmatched quote");
+							break;
+						}
 					} while (*toline != '"');
 					break;
 				default:
-- 
1.7.12.1