librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Include an extra byte for the nul-terminator, otherwise we may end up
with an out-of-bounds write.

The corresponding bug in the kernel implementation was fixed by commit
e3081f7e3e ("kgssapi(4): Fix string overrun in Kerberos principal construction").

Reviewed by:	markj
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D57738

(cherry picked from commit 635ad6f2ec)
This commit is contained in:
Jane Smith authored and Mark Johnston committed 2026-07-08 18:09:35 +00:00
1 parent b365fc1ad2
commit fae2b85dfe
1 file changed
+1 -1
+1 -1
View File
@@ -247,7 +247,7 @@ rpc_gss_get_principal_name(rpc_gss_principal_t *principal,
* Construct a gss_buffer containing the full name formatted
* as "name/node@domain" where node and domain are optional.
*/
namelen = strlen(name);
namelen = strlen(name) + 1;
if (node) {
namelen += strlen(node) + 1;
}