From: Sebastian Andrzej Siewior Date: Wed, 3 Jul 2024 22:49:27 +0200 Subject: [PATCH] smtppass: Correct strncat() invocation. strncat() expects copies at most length_bytes + 1 therefore the buffer must be strlen(dest) + strlen(src) + 1 to cover everything. Signed-off-by: Sebastian Andrzej Siewior --- common/smtppass.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/common/smtppass.c b/common/smtppass.c index baa2c558de6a..e28fd890faa9 100644 --- a/common/smtppass.c +++ b/common/smtppass.c @@ -1864,12 +1864,15 @@ static void vmessage(spctx_t* ctx, int level, int err, if(err) { + int left_bytes; /* strerror_r doesn't want to work for us for some reason len = strlen(buf); strerror_r(e, buf + len, MAX_MSGLEN - len); */ sp_lock(); - strncat(buf, strerror(e), MAX_MSGLEN); + left_bytes = MAX_MSGLEN -1 - strlen(buf) - strlen(strerror(e)); + if (left_bytes > 0) + strncat(buf, strerror(e), left_bytes); sp_unlock(); } -- 2.45.2