HomeFreeBSD

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Description

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Include an extra byte for the nul-terminator, otherwise we may end up
with an out-of-bounds write.

The corresponding bug in the kernel implementation was fixed by commit
e3081f7e3e2d ("kgssapi(4): Fix string overrun in Kerberos principal construction").

Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57738

Details

Provenance
thebugfixers_pm.meAuthored on Jun 22 2026, 9:40 PM
markjCommitted on Jun 22 2026, 9:44 PM
Reviewer
markj
Differential Revision
D57738: Off‑by‑one heap buffer overflow in rpc_gss_get_principal_name
Parents
rG95ff2acb5555: acpi: Set 'acpi_sstate' closer to setting 'acpi_stype'
Branches
Unknown
Tags
Unknown