[Exim] Wrong using string_sprintf() in rf_get_munge_headers(…

Hi,

In function rf_get_munge_headers() is used string_sprintf() to concatenate
strings, but in case when size of expand_string(rblock->extra_headers)
> STRING_SPRINTF_BUFFER_SIZE we have a trouble.

In real life exim do nothing with messages that have very long "To:" :

>mailq

63d   23K 1BSQgf-000AvD-Ht <apache@???>
          sand@???

>exim -v -M 1BSQgf-000AvD-Ht
LOG: MAIN PANIC DIE
string_sprintf expansion was longer than 8192


Exim config :

userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  no_verify
  no_expn
  check_ancestor
 allow_filter
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  headers_remove = from:to:cc
  headers_add = "${if def:header_from: {From: ${perl{strip_trailing_space_characters}{$h_from:}}\n} }\
                ${if def:header_to:   {To: ${perl{strip_trailing_space_characters}{$h_to:}}\n} }\
                 ${if def:header_cc:   {Cc: ${perl{strip_trailing_space_characters}{$h_cc:}}\n} }"

>cat ~sand/.forward

# Exim filter <<== do not edit or remove this line!

if $header_to: contains "sand@???"
then
save $home/Mail/archive
endif
if $header_cc: contains "sand@???"
then
save $home/Mail/archive
endif

So exim have troubles with modifying header by header_add routine.
--
-------------------------------------------------
Andrew V Stikheev               Russian Institute
E-mail: sand@???                  for
Phone:+7 095 192-9179            Public Networks