Use mu_make_file_name where necessary.

* comsat/action.c (run_user_action): Use mu_make_file_name.
* imap4d/lsub.c (imap4d_lsub): Likewise.
* imap4d/subscribe.c (imap4d_subscribe): Likewise.
* imap4d/unsubscribe.c (imap4d_unsubscribe): Likewise.
* libmailutils/base/filename.c (mu_get_full_path): Likewise.
* libmailutils/base/tempfile.c (mu_tempfile): Likewise.
* libmailutils/base/url.c (_url_path_default): Likewise.
* libmu_auth/virtual.c (getpwnam_virtual)
(mu_auth_virt_domain_by_name): Likewise.
* libmu_sieve/extensions/vacation.c (check_db): Likewise.
* libmu_sieve/sieve.l (_try_include): Likewise.
* maidag/forward.c (maidag_forward): Likewise.

* mh/mh.h (mh_safe_make_file_name): New proto.
* mh/mh_init.c (mh_audit_open,mh_get_dir)
(mh_expand_name,mh_real_install): Use mh_safe_make_file_name.
(mh_safe_make_file_name): New function.
* mh/folder.c (read_seq_file, _scan): Use mh_safe_make_file_name.
* mh/mh_global.c (mh_read_profile, _mh_init_global_sequences): Likewise.
* mh/install-mh.c (main): Likewise.
* mh/mhn.c (normalize_path, store_handler, main): Likewise.
* mh/repl.c (make_draft): Likewise.
* mh/rmf.c (rmf): Likewise.
* mh/sortm.c (swap_message): Likewise.
* mimeview/mimetypes.l (mimetypes_open): Likewise.

* lib/mailcap.c: Add error checking.

@@ -375,9 +375,15 @@ run_user_action (FILE *tty, const char *cr, mu_message_t msg)
       char *cwd = mu_getcwd ();
       char *rcname;
 
-      mu_asprintf (&rcname, "%s/%s", cwd, BIFF_RC);
+      rcname = mu_make_file_name (cwd, BIFF_RC);
       free (cwd);
-      
+      if (!rcname)
+        {
+          mu_diag_funcall (MU_DIAG_ERROR, "mu_make_file_name", NULL, ENOMEM);
+          fclose (fp);
+          return;
+        }
+        
       mu_diag_get_debug (&debug);
       
       while ((n = act_getline (fp, &stmt, &size)))

@@ -34,8 +34,8 @@ imap4d_lsub (struct imap4d_command *command, imap4d_tokbuf_t tok)
 {
   char *ref;
   char *wcard;
-  char *file = NULL;
-  char *pattern = NULL;
+  char *file;
+  char *pattern;
   const char *delim = "/";
   FILE *fp;
   
@@ -45,11 +45,11 @@ imap4d_lsub (struct imap4d_command *command, imap4d_tokbuf_t tok)
   ref = imap4d_tokbuf_getarg (tok, IMAP4_ARG_1);
   wcard = imap4d_tokbuf_getarg (tok, IMAP4_ARG_2);
 
-  asprintf (&pattern, "%s%s", ref, wcard);
+  pattern = mu_make_file_name (ref, wcard);
   if (!pattern)
     return io_completion_response (command, RESP_NO, "Not enough memory");
   
-  asprintf (&file, "%s/.mailboxlist", real_homedir);
+  file = mu_make_file_name (real_homedir, ".mailboxlist");
   if (!file)
     {
       free (pattern);

@@ -40,7 +40,9 @@ imap4d_subscribe (struct imap4d_command *command, imap4d_tokbuf_t tok)
 
   name = imap4d_tokbuf_getarg (tok, IMAP4_ARG_1);
 
-  asprintf (&file, "%s/.mailboxlist", real_homedir);
+  file = mu_make_file_name (real_homedir, ".mailboxlist");
+  if (!file)
+    return io_completion_response (command, RESP_NO, "Cannot subscribe");
   fp = fopen (file, "a");
   free (file);
   if (fp)

@@ -99,7 +99,13 @@ imap4d_unsubscribe (struct imap4d_command *command, imap4d_tokbuf_t tok)
 
   name = imap4d_tokbuf_getarg (tok, IMAP4_ARG_1);
 
-  asprintf (&file, "%s/.mailboxlist", real_homedir);
+  file = mu_make_file_name (real_homedir, ".mailboxlist");
+  if (!file)
+    {
+      mu_diag_funcall (MU_DIAG_ERROR, "mu_make_file_name", NULL, ENOMEM);
+      return io_completion_response (command, RESP_NO, "Cannot unsubscribe");
+    }
+
   sd.result = 0;
   sd.name = name;
 

@@ -660,10 +660,12 @@ display_stream_mailcap (const char *ident, mu_stream_t stream, mu_header_t hdr,
       char *home = mu_get_homedir ();
       asprintf (&mailcap_path, "%s/.mailcap:%s", home, DEFAULT_MAILCAP);
       free (home);
+      if (!mailcap_path)
+        return 1;
     }
   else
     mailcap_path = strdup (mailcap_path);
-
+  
   obstack_init (&expand_stack);
   
   for (p = strtok_r (mailcap_path, ":", &sp); p; p = strtok_r (NULL, ":", &sp))

@@ -59,14 +59,11 @@ mu_get_full_path (const char *file)
       char *cwd = mu_getcwd ();
       if (cwd)
 	{
-	  p = calloc (strlen (cwd) + 1 + strlen (file) + 1, 1);
-	  if (p)
-	    sprintf (p, "%s/%s", cwd, file);
+	  p = mu_make_file_name (cwd, file);
 	  free (cwd);
 	}
     }
-
-  if (!p)
+  else
     p = strdup (file);
   return p;
 }

@@ -31,6 +31,7 @@
 #include <mailutils/io.h>
 #include <mailutils/error.h>
 #include <mailutils/errno.h>
+#include <mailutils/util.h>
 
 /* Create and open a temporary file. Be very careful about it, since we
    may be running with extra privilege i.e setgid().
@@ -52,8 +53,12 @@ mu_tempfile (const char *tmpdir, char **namep)
   if (!tmpdir)
     tmpdir = (getenv ("TMPDIR")) ? getenv ("TMPDIR") : P_tmpdir;
 
-  if (mu_asprintf (&filename, "%s/muXXXXXX", tmpdir))
-    return -1;
+  filename = mu_make_file_name (tmpdir, "muXXXXXX");
+  if (!filename)
+    {
+      mu_diag_funcall (MU_DIAG_ERROR, "mu_make_file_name", NULL, ENOMEM);
+      return -1;
+    }
 
 #ifdef HAVE_MKSTEMP
   {

@@ -956,12 +956,7 @@ mu_url_init (mu_url_t url, int port, const char *scheme)
 static char *
 _url_path_default (const char *spooldir, const char *user, int unused)
 {
-  char *mbox = malloc (strlen (spooldir) + strlen (user) + 2);
-  if (!mbox)
-    errno = ENOMEM;
-  else
-    sprintf (mbox, "%s/%s", spooldir, user);
-  return mbox;
+  return mu_make_file_name (spooldir, user);
 }
 
 /* Hashed indexing */

@@ -52,6 +52,7 @@
 #include <mailutils/mu_auth.h>
 #include <mailutils/nls.h>
 #include <mailutils/errno.h>
+#include <mailutils/util.h>
 
 #ifdef ENABLE_VIRTUAL_DOMAINS
 
@@ -89,12 +90,10 @@ getpwnam_virtual (const char *u)
   if (delim == 0)
     return NULL;
 
-  filename = malloc (strlen (mu_virtual_module_config.pwddir) +
-		     strlen (&u[delim + 1]) + 2 /* slash and null byte */);
+  filename = mu_make_file_name (mu_virtual_module_config.pwddir, &u[delim + 1]);
   if (filename == NULL)
     return NULL;
 
-  sprintf (filename, "%s/%s", mu_virtual_module_config.pwddir, &u[delim + 1]);
   pfile = fopen (filename, "r");
   free (filename);
 
@@ -173,10 +172,9 @@ mu_auth_virt_domain_by_name (struct mu_auth_data **return_data,
 	return MU_ERR_AUTH_FAILURE;
     }
   
-  mailbox_name = calloc (strlen (pw->pw_dir) + strlen ("/INBOX") + 1, 1);
+  mailbox_name = mu_make_file_name (pw->pw_dir, "INBOX");
   if (!mailbox_name)
     return ENOMEM;
-  sprintf (mailbox_name, "%s/INBOX", pw->pw_dir);
 
   rc = mu_auth_data_alloc (return_data,
 			   pw->pw_name,

@@ -300,7 +300,8 @@ check_db (mu_sieve_machine_t mach, mu_list_t tags, char *from)
 
   home = mu_get_homedir ();
 
-  if (asprintf (&file, "%s/.vacation", (home ? home : ".")) == -1)
+  file = mu_make_file_name (home ? home : ".", ".vacation");
+  if (!file)
     {
       mu_sieve_error (mach, _("%lu: cannot build db file name"),
 		      (unsigned long) mu_sieve_get_message_num (mach));

@@ -349,11 +349,13 @@ static int
 _try_include (void *item, void *data)
 {
   char **dir = data;
-  char *name = malloc (strlen (item) + 1 + strlen (*dir) + 1);
+  char *name = mu_make_file_name ((char*) item, *dir);
 
   if (!name)
-    return 0;
-  sprintf (name, "%s/%s", (char*) item, *dir);
+    {
+      mu_diag_funcall (MU_DIAG_ERROR, "mu_make_file_name", NULL, ENOMEM);
+      return 0;
+    }
   if (access (name, R_OK) == 0)
     {
       *(char**) data = name;

@@ -342,7 +342,7 @@ maidag_forward (mu_message_t msg, struct mu_auth_data *auth, char *fwfile)
 		      auth->dir, mu_strerror (errno));
 	  return maidag_forward_none;
 	}
-      asprintf (&filename, "%s/%s", auth->dir, fwfile);
+      filename = mu_make_file_name (auth->dir, fwfile);
     }
   else
     filename = strdup (fwfile);

@@ -275,9 +275,7 @@ read_seq_file (struct folder_info *info, const char *prefix, const char *name)
   mh_context_t *ctx;
   const char *p;
   
-  asprintf (&pname, "%s/%s", prefix, name);
-  if (!pname)
-    abort ();
+  pname = mh_safe_make_file_name (prefix, name);
   ctx = mh_context_create (pname, 1);
   mh_context_read (ctx);
   
@@ -350,7 +348,7 @@ _scan (const char *name, size_t depth)
 	}
       else if (entry->d_name[0] != ',')
 	{
-	  asprintf (&p, "%s/%s", name, entry->d_name);
+	  p = mh_safe_make_file_name (name, entry->d_name);
 	  if (stat (p, &st) < 0)
 	    mu_diag_funcall (MU_DIAG_ERROR, "stat", p, errno);
 	  else if (S_ISDIR (st.st_mode))
@@ -378,7 +376,7 @@ _scan (const char *name, size_t depth)
   
   if (info.cur)
     {
-      asprintf (&p, "%s/%s", name, mu_umaxtostr (0, info.cur));
+      p = mh_safe_make_file_name (name, mu_umaxtostr (0, info.cur));
       if (stat (p, &st) < 0 || !S_ISREG (st.st_mode))
 	info.cur = 0;
       free (p);

@@ -71,8 +71,7 @@ main (int argc, char **argv)
   home = mu_get_homedir ();
   if (!home)
     abort (); /* shouldn't happen */
-  asprintf (&name, "%s/%s", home, MH_USER_PROFILE);
-  
+  name = mh_safe_make_file_name (home, MH_USER_PROFILE);
   mh_install (name, automode);
   return 0;
 }

@@ -368,3 +368,5 @@ int check_draft_disposition (struct mh_whatnow_env *wh, int use_draft);
 void ali_parse_error (const char *fmt, ...) MU_PRINTFLIKE(1,2); 
 void ali_verbatim (int enable);
 
+char *mh_safe_make_file_name (const char *dir, const char *file);
+  

@@ -61,7 +61,7 @@ mh_read_profile ()
       char *home = mu_get_homedir ();
       if (!home)
 	abort (); /* shouldn't happen */
-      asprintf (&p, "%s/%s", home, MH_USER_PROFILE);
+      p = mh_safe_make_file_name (home, MH_USER_PROFILE);
       free (home);
     }
 
@@ -152,7 +152,7 @@ _mh_init_global_sequences ()
   _mh_init_global_context ();
   name = mh_global_profile_get ("mh-sequences", MH_SEQUENCES_FILE);
   p = mh_expand_name (NULL, current_folder, 0);
-  asprintf (&seq_name, "%s/%s", p, name);
+  seq_name = mh_safe_make_file_name (p, name);
   free (p);
   sequences = mh_context_create (seq_name, 1);
   if (mh_context_read (sequences) == 0)

@@ -381,14 +381,7 @@ mh_audit_open (char *name, mu_mailbox_t mbox)
   namep = mu_tilde_expansion (name, "/", NULL);
   if (strchr (namep, '/') == NULL)
     {
-      char *p = NULL;
-
-      asprintf (&p, "%s/%s", mu_folder_directory (), namep);
-      if (!p)
-	{
-	  mu_error (_("not enough memory"));
-	  exit (1);
-	}
+      char *p = mh_safe_make_file_name (mu_folder_directory (), namep);
       free (namep);
       namep = p;
     }
@@ -467,11 +460,16 @@ mh_get_dir ()
   if (mhdir[0] != '/')
     {
       char *p = mu_get_homedir ();
-      asprintf (&mhcopy, "%s/%s", p, mhdir);
+      mhcopy = mh_safe_make_file_name (p, mhdir);
       free (p);
     }
   else 
     mhcopy = strdup (mhdir);
+  if (!mhcopy)
+    {
+      mu_error (_("not enough memory"));
+      abort ();
+    }
   return mhcopy;
 }
 
@@ -487,8 +485,7 @@ mh_expand_name (const char *base, const char *name, int is_folder)
   else if (strncmp (namep, "../", 3) == 0 || strncmp (namep, "./", 2) == 0)
     {
       char *cwd = mu_getcwd ();
-      char *tmp = NULL;
-      asprintf (&tmp, "%s/%s", cwd, namep);
+      char *tmp = mh_safe_make_file_name (cwd, namep);
       free (cwd);
       free (namep);
       namep = tmp;
@@ -698,7 +695,7 @@ mh_real_install (char *name, int automode)
   char *ctx;
   FILE *fp;
   
-  asprintf (&mhdir, "%s/%s", home, "Mail");
+  mhdir = mh_safe_make_file_name (home, "Mail");
   
   if (!automode)
     {
@@ -736,7 +733,7 @@ mh_real_install (char *name, int automode)
 	  free (mhdir);
 	  if (local)
 	    {
-	      asprintf (&mhdir, "%s/%s", home, p);
+              mhdir = mh_safe_make_file_name (home, p);
 	      free (p);
 	    }
 	  else
@@ -756,7 +753,7 @@ mh_real_install (char *name, int automode)
   fprintf (fp, "Path: %s\n", mhdir);
   fclose (fp);
 
-  asprintf (&ctx, "%s/%s", mhdir, MH_CONTEXT_FILE);
+  ctx = mh_safe_make_file_name (mhdir, MH_CONTEXT_FILE);
   fp = fopen (ctx, "w");
   if (fp)
     {
@@ -764,7 +761,7 @@ mh_real_install (char *name, int automode)
       fclose (fp);
     }
   free (ctx);
-  asprintf (&ctx, "%s/inbox", mhdir);
+  ctx = mh_safe_make_file_name (mhdir, "inbox");
   if (mh_check_folder (ctx, !automode))
     exit (1);
   free (ctx);
@@ -1029,3 +1026,17 @@ mh_draft_message (const char *name, const char *msgspec, char **pname)
   mu_mailbox_destroy (&mbox);
   return rc;
 }
+
+char *
+mh_safe_make_file_name (const char *dir, const char *file)
+{
+  file = mu_make_file_name (dir, file);
+  if (!file)
+    {
+      mu_diag_funcall (MU_DIAG_ERROR, "mu_make_file_name", NULL, ENOMEM);
+      abort ();
+    }
+  return file;
+}
+
+			  

@@ -1487,10 +1487,7 @@ normalize_path (const char *cwd, char *path)
   if (!cwd)
     cwd = pcwd = mu_getcwd ();
 
-  len = strlen (cwd) + strlen (path) + 2;
-  p = xmalloc (len);
-  sprintf (p, "%s/%s", cwd, path);
-  path = p;
+  path = mh_safe_make_file_name (cwd, path);
 
   /* delete trailing delimiter if any */
   if (len && path[len-1] == '/')
@@ -1576,7 +1573,7 @@ store_handler (mu_message_t msg, msg_part_t part, char *type, char *encoding,
     {
       char *fname = mhn_store_command (msg, part, prefix);
       if (dir)
-	asprintf (&name, "%s/%s", dir, fname);
+	name = mh_safe_make_file_name (dir, fname);
       else
 	name = fname;
     }
@@ -2670,7 +2667,7 @@ main (int argc, char **argv)
     case mode_compose:
       /* Prepare filename for diagnostic purposes */
       if (input_file[0] != '/')
-	asprintf (&input_file, "%s/%s", mu_folder_directory (), input_file);
+	input_file = mh_safe_make_file_name (mu_folder_directory (), input_file);
       rc = mhn_compose ();
       break;
       

@@ -372,8 +372,8 @@ make_draft (mu_mailbox_t mbox, int disp, struct mh_whatnow_env *wh)
     
     mu_mailbox_get_url (mbox, &url);
     mh_message_number (msg, &num);
-    asprintf (&msgname, "%s/%s",
-	      mu_url_to_string (url), mu_umaxtostr (0, num));
+    msgname = mh_safe_make_file_name (mu_url_to_string (url), 
+                                      mu_umaxtostr (0, num));
     p = strchr (msgname, ':');
     if (!p)
       wh->msg = msgname;

@@ -131,7 +131,7 @@ rmf (const char *name)
 	  || strcmp (entry->d_name, "..") == 0)
 	continue;
       
-      asprintf (&p, "%s/%s", name, entry->d_name);
+      p = mh_safe_make_file_name (name, entry->d_name);
       if (stat (p, &st) < 0)
 	{
 	  mu_diag_funcall (MU_DIAG_ERROR, "stat", p, errno);

@@ -447,8 +447,8 @@ swap_message (size_t a, size_t b)
   char *path_a, *path_b;
   char *tmp;
   
-  asprintf (&path_a, "%s/%s", mbox_path, mu_umaxtostr (0, a));
-  asprintf (&path_b, "%s/%s", mbox_path, mu_umaxtostr (1, b));
+  path_a = mh_safe_make_file_name (mbox_path, mu_umaxtostr (0, a));
+  path_b = mh_safe_make_file_name (mbox_path, mu_umaxtostr (1, b));
   tmp = mu_tempname (mbox_path);
   rename (path_a, tmp);
   unlink (path_a);

@@ -153,7 +153,7 @@ mimetypes_open (const char *name)
   
   if (S_ISDIR (st.st_mode))
     {
-      asprintf (&file_name, "%s/mime.types", name);
+      file_name = mu_make_file_name (name, "mime.types");
       file_name_alloc = 1;
     }
   else