HomeFreeBSD

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Description

librpcsec_gss: Fix an off-by-one in rpc_gss_get_principal_name()

Include an extra byte for the nul-terminator, otherwise we may end up
with an out-of-bounds write.

The corresponding bug in the kernel implementation was fixed by commit
e3081f7e3e2d ("kgssapi(4): Fix string overrun in Kerberos principal construction").

Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57738

(cherry picked from commit 635ad6f2ec97e9c6b1f15620cd5ee84eb632082f)

Details

Provenance
thebugfixers_pm.meAuthored on Jun 22 2026, 9:40 PM
markjCommitted on Jul 8 2026, 6:09 PM
Reviewer
markj
Differential Revision
D57738: Off‑by‑one heap buffer overflow in rpc_gss_get_principal_name
Parents
rGb365fc1ad2cc: makefs/zfs: Explicitly include sys/param.h for nitems()
Branches
Unknown
Tags
Unknown