fix crash in mutt_extract_token()

The first attempt to fix the crash in mutt_extract_token() just moved
the problem.  This refactors the code to simplify the shuffling of
strings.

init.c

@@ -2735,9 +2735,6 @@ int mutt_extract_token(struct Buffer *dest, struct Buffer *tok, TokenFlags flags
     {
       FILE *fp = NULL;
       pid_t pid;
-      char *ptr = NULL;
-      size_t expnlen;
-      struct Buffer expn;
       int line = 0;
 
       pc = tok->dptr;
@@ -2783,7 +2780,7 @@ int mutt_extract_token(struct Buffer *dest, struct Buffer *tok, TokenFlags flags
       tok->dptr = pc + 1;
 
       /* read line */
-      mutt_buffer_init(&expn);
+      struct Buffer expn = mutt_buffer_make(0);
       expn.data = mutt_file_read_line(NULL, &expn.dsize, fp, &line, 0);
       mutt_file_fclose(&fp);
       mutt_wait_filter(pid);
@@ -2792,21 +2789,22 @@ int mutt_extract_token(struct Buffer *dest, struct Buffer *tok, TokenFlags flags
        * plus whatever else was left on the original line */
       /* BUT: If this is inside a quoted string, directly add output to
        * the token */
-      if (expn.data && qc)
+      if (expn.data)
       {
-        mutt_buffer_addstr(dest, expn.data);
-        FREE(&expn.data);
-      }
-      else if (expn.data)
-      {
-        expnlen = mutt_str_strlen(expn.data);
-        tok->dsize = expnlen + mutt_str_strlen(tok->dptr) + 1;
-        ptr = mutt_mem_malloc(tok->dsize);
-        memcpy(ptr, expn.data, expnlen);
-        strcpy(ptr + expnlen, tok->dptr);
-        mutt_buffer_strcpy(tok, ptr);
-        tok->dptr = tok->data;
-        FREE(&ptr);
+        if (qc)
+        {
+          mutt_buffer_addstr(dest, expn.data);
+        }
+        else
+        {
+          struct Buffer *copy = mutt_buffer_pool_get();
+          mutt_buffer_fix_dptr(&expn);
+          mutt_buffer_copy(copy, &expn);
+          mutt_buffer_addstr(copy, tok->dptr);
+          mutt_buffer_copy(tok, copy);
+          tok->dptr = tok->data;
+          mutt_buffer_pool_release(&copy);
+        }
         FREE(&expn.data);
       }
     }