HomeFreeBSD

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Description

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Include an extra byte for the nul-terminator, otherwise we may end up
with an out-of-bounds write.

The corresponding bug in the kernel implementation was fixed by commit
e3081f7e3e2d ("kgssapi(4): Fix string overrun in Kerberos principal construction").

Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57738

(cherry picked from commit 635ad6f2ec97e9c6b1f15620cd5ee84eb632082f)

Details

Provenance
thebugfixers_pm.meAuthored on Jun 22 2026, 9:40 PM
markjCommitted on Jul 14 2026, 2:08 PM
Reviewer
markj
Differential Revision
D57738: Off‑by‑one heap buffer overflow in rpc_gss_get_principal_name
Parents
rGcdd4f32526f5: if_ovpn: Fix a lock leak in an error path
Branches
Unknown
Tags
Unknown