Index: apps/app_voicemail.c
===================================================================
--- apps/app_voicemail.c	(revision 188835)
+++ apps/app_voicemail.c	(working copy)
@@ -3455,8 +3455,8 @@
 	char tmpcmd[256];
 	struct ast_tm tm;
 	char enc_cidnum[256] = "", enc_cidname[256] = "";
-	char *passdata = NULL, *passdata2;
-	size_t len_passdata = 0, len_passdata2, tmplen;
+	struct ast_str *passdata = ast_str_create(16), *passdata2 = ast_str_create(16);
+	size_t len_passdata2, tmplen;
 	char *greeting_attachment;
 
 #ifdef IMAP_STORAGE
@@ -3465,7 +3465,13 @@
 #define ENDL "\n"
 #endif
 
-	/* One alloca for multiple fields */
+	if (!passdata || !passdata2) {
+		ast_free(passdata);
+		ast_free(passdata2);
+		return;
+	}
+
+	/* One alloc for multiple fields */
 	len_passdata2 = strlen(vmu->fullname);
 	if (emailsubject && (tmplen = strlen(emailsubject)) > len_passdata2) {
 		len_passdata2 = tmplen;
@@ -3474,7 +3480,7 @@
 		len_passdata2 = tmplen;
 	}
 	len_passdata2 = len_passdata2 * 3 + 200;
-	passdata2 = alloca(len_passdata2);
+	ast_str_make_space(&passdata2, len_passdata2);
 
 	if (!ast_strlen_zero(cidnum)) {
 		strip_control(cidnum, enc_cidnum, sizeof(enc_cidnum));
@@ -3504,23 +3510,24 @@
 		struct ast_channel *ast;
 		if ((ast = ast_channel_alloc(0, AST_STATE_DOWN, 0, 0, "", "", "", 0, "Substitution/voicemail"))) {
 			char *ptr;
-			memset(passdata2, 0, len_passdata2);
-			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, enc_cidnum, enc_cidname, dur, date, passdata2, len_passdata2, category);
-			pbx_substitute_variables_helper(ast, fromstring, passdata2, len_passdata2);
-			len_passdata = strlen(passdata2) * 3 + 300;
-			passdata = alloca(len_passdata);
-			if (check_mime(passdata2)) {
+			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, enc_cidnum, enc_cidname, dur, date, ast_str_buffer(passdata2), ast_str_size(passdata2), category);
+			pbx_substitute_variables_helper(ast, fromstring, ast_str_buffer(passdata2), ast_str_size(passdata2));
+			ast_str_update(passdata2);
+			tmplen = ast_str_strlen(passdata2) * 3 + 300;
+			ast_str_make_space(&passdata, tmplen);
+			if (check_mime(ast_str_buffer(passdata2))) {
 				int first_line = 1;
-				encode_mime_str(passdata2, passdata, len_passdata, strlen("From: "), strlen(who) + 3);
-				while ((ptr = strchr(passdata, ' '))) {
+				char *ptr2 = ast_str_buffer(passdata);
+				encode_mime_str(ast_str_buffer(passdata2), ast_str_buffer(passdata), ast_str_size(passdata), strlen("From: "), strlen(who) + 3);
+				while ((ptr = strchr(ptr2, ' '))) {
 					*ptr = '\0';
-					fprintf(p, "%s %s" ENDL, first_line ? "From:" : "", passdata);
+					fprintf(p, "%s %s" ENDL, first_line ? "From:" : "", ptr2);
 					first_line = 0;
-					passdata = ptr + 1;
+					ptr2 = ptr + 1;
 				}
-				fprintf(p, "%s %s <%s>" ENDL, first_line ? "From:" : "", passdata, who);
+				fprintf(p, "%s %s <%s>" ENDL, first_line ? "From:" : "", ptr2, who);
 			} else {
-				fprintf(p, "From: %s <%s>" ENDL, quote(passdata2, passdata, len_passdata), who);
+				fprintf(p, "From: %s <%s>" ENDL, quote(ast_str_buffer(passdata2), ast_str_buffer(passdata), ast_str_size(passdata)), who);
 			}
 			ast_channel_free(ast);
 		} else {
@@ -3532,44 +3539,41 @@
 
 	if (check_mime(vmu->fullname)) {
 		int first_line = 1;
-		char *ptr;
-		encode_mime_str(vmu->fullname, passdata2, len_passdata2, strlen("To: "), strlen(vmu->email) + 3);
-		while ((ptr = strchr(passdata2, ' '))) {
+		char *ptr, *ptr2 = ast_str_buffer(passdata2);
+		encode_mime_str(vmu->fullname, ast_str_buffer(passdata2), ast_str_size(passdata2), strlen("To: "), strlen(vmu->email) + 3);
+		while ((ptr = strchr(ptr2, ' '))) {
 			*ptr = '\0';
-			fprintf(p, "%s %s" ENDL, first_line ? "To:" : "", passdata2);
+			fprintf(p, "%s %s" ENDL, first_line ? "To:" : "", ptr2);
 			first_line = 0;
-			passdata2 = ptr + 1;
+			ptr2 = ptr + 1;
 		}
-		fprintf(p, "%s %s <%s>" ENDL, first_line ? "To:" : "", passdata2, vmu->email);
+		fprintf(p, "%s %s <%s>" ENDL, first_line ? "To:" : "", ptr2, vmu->email);
 	} else {
-		fprintf(p, "To: %s <%s>" ENDL, quote(vmu->fullname, passdata2, len_passdata2), vmu->email);
+		fprintf(p, "To: %s <%s>" ENDL, quote(vmu->fullname, ast_str_buffer(passdata2), ast_str_size(passdata2)), vmu->email);
 	}
 	if (!ast_strlen_zero(emailsubject)) {
 		struct ast_channel *ast;
 		if ((ast = ast_channel_alloc(0, AST_STATE_DOWN, 0, 0, "", "", "", 0, "Substitution/voicemail"))) {
 			int vmlen = strlen(emailsubject) * 3 + 200;
 			/* Only allocate more space if the previous was not large enough */
-			if (vmlen > len_passdata) {
-				passdata = alloca(vmlen);
-				len_passdata = vmlen;
-			}
+			ast_str_make_space(&passdata, vmlen);
 
-			memset(passdata, 0, len_passdata);
-			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, cidnum, cidname, dur, date, passdata, len_passdata, category);
-			pbx_substitute_variables_helper(ast, emailsubject, passdata, len_passdata);
-			if (check_mime(passdata)) {
+			memset(ast_str_buffer(passdata), 0, ast_str_size(passdata));
+			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, cidnum, cidname, dur, date, ast_str_buffer(passdata), ast_str_size(passdata), category);
+			pbx_substitute_variables_helper(ast, emailsubject, ast_str_buffer(passdata), ast_str_size(passdata));
+			if (check_mime(ast_str_buffer(passdata))) {
 				int first_line = 1;
-				char *ptr;
-				encode_mime_str(passdata, passdata2, len_passdata2, strlen("Subject: "), 0);
-				while ((ptr = strchr(passdata2, ' '))) {
+				char *ptr, *ptr2 = ast_str_buffer(passdata2);
+				encode_mime_str(ast_str_buffer(passdata), ptr2, ast_str_size(passdata2), strlen("Subject: "), 0);
+				while ((ptr = strchr(ptr2, ' '))) {
 					*ptr = '\0';
-					fprintf(p, "%s %s" ENDL, first_line ? "Subject:" : "", passdata2);
+					fprintf(p, "%s %s" ENDL, first_line ? "Subject:" : "", ptr2);
 					first_line = 0;
-					passdata2 = ptr + 1;
+					ptr2 = ptr + 1;
 				}
-				fprintf(p, "%s %s" ENDL, first_line ? "Subject:" : "", passdata2);
+				fprintf(p, "%s %s" ENDL, first_line ? "Subject:" : "", ptr2);
 			} else {
-				fprintf(p, "Subject: %s" ENDL, passdata);
+				fprintf(p, "Subject: %s" ENDL, ast_str_buffer(passdata));
 			}
 			ast_channel_free(ast);
 		} else {
@@ -3626,13 +3630,12 @@
 	if (emailbody) {
 		struct ast_channel *ast;
 		if ((ast = ast_channel_alloc(0, AST_STATE_DOWN, 0, 0, "", "", "", 0, "Substitution/voicemail"))) {
-			char *passdata;
 			int vmlen = strlen(emailbody) * 3 + 200;
-			passdata = alloca(vmlen);
-			memset(passdata, 0, vmlen);
-			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, cidnum, cidname, dur, date, passdata, vmlen, category);
-			pbx_substitute_variables_helper(ast, emailbody, passdata, vmlen);
-			fprintf(p, "%s" ENDL, passdata);
+			ast_str_make_space(&passdata, vmlen);
+			memset(ast_str_buffer(passdata), 0, ast_str_size(passdata));
+			prep_email_sub_vars(ast, vmu, msgnum + 1, context, mailbox, fromfolder, cidnum, cidname, dur, date, ast_str_buffer(passdata), ast_str_size(passdata), category);
+			pbx_substitute_variables_helper(ast, emailbody, ast_str_buffer(passdata), ast_str_size(passdata));
+			fprintf(p, "%s" ENDL, ast_str_buffer(passdata));
 			ast_channel_free(ast);
 		} else
 			ast_log(LOG_WARNING, "Cannot allocate the channel for variables substitution\n");
@@ -3731,6 +3734,8 @@
 		}
 	}
 #undef ENDL
+	ast_free(passdata);
+	ast_free(passdata2);
 }
 
 static int sendmail(char *srcemail, struct ast_vm_user *vmu, int msgnum, char *context, char *mailbox, const char *fromfolder, char *cidnum, char *cidname, char *attach, char *format, int duration, int attach_user_voicemail, struct ast_channel *chan, const char *category)