mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-10-28 11:25:21 +01:00
librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()
Include an extra byte for the nul-terminator, otherwise we may end up with an out-of-bounds write. The corresponding bug in the kernel implementation was fixed by commite3081f7e3e("kgssapi(4): Fix string overrun in Kerberos principal construction"). Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57738 (cherry picked from commit635ad6f2ec)
This commit is contained in:
1 parent
b365fc1ad2
commit
fae2b85dfe
1 file changed
+1
-1
@@ -247,7 +247,7 @@ rpc_gss_get_principal_name(rpc_gss_principal_t *principal,
|
||||
* Construct a gss_buffer containing the full name formatted
|
||||
* as "name/node@domain" where node and domain are optional.
|
||||
*/
|
||||
namelen = strlen(name);
|
||||
namelen = strlen(name) + 1;
|
||||
if (node) {
|
||||
namelen += strlen(node) + 1;
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user