librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Include an extra byte for the nul-terminator, otherwise we may end up
with an out-of-bounds write.

The corresponding bug in the kernel implementation was fixed by commit
e3081f7e3e ("kgssapi(4): Fix string overrun in Kerberos principal construction").

Reviewed by:	markj
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D57738
This commit is contained in:
Jane Smith authored and Mark Johnston committed 2026-06-22 21:44:44 +00:00
1 parent 95ff2acb55
commit 635ad6f2ec
1 file changed
+1 -1
+1 -1
View File
@@ -247,7 +247,7 @@ rpc_gss_get_principal_name(rpc_gss_principal_t *principal,
* Construct a gss_buffer containing the full name formatted
* as "name/node@domain" where node and domain are optional.
*/
namelen = strlen(name);
namelen = strlen(name) + 1;
if (node) {
namelen += strlen(node) + 1;
}