[PATCH 1/1] libtirpc: fix rpc_gss_get_principal_name to allocate memory correctly

The calculation for `namebuf.length` correctly accounts for the separator
characters ("/" and "@") via the +1 in `nodelen` and `secdomlen`, but does
NOT include space for the C string NUL terminator. The subsequent
`strcpy()` and `strcat()` calls write a NUL terminator that overflows the
buffer by exactly 1 byte in all cases:

- **node=NULL, secdomain=NULL:** allocates `strlen(user_name)`, writes
  `strlen(user_name) + 1` bytes. Overflow: 1 byte.
- **node="host", secdomain=NULL:** allocates
  `strlen(user_name) + strlen(node) + 1`, writes
  `strlen(user_name) + 1 + strlen(node) + 1` bytes. Overflow: 1 byte.
- **Both non-NULL:** same pattern, always 1 byte short.

The `namebuf.length` value is intentionally the *payload* length (without
NUL) for the subsequent `gss_import_name()` call, so the bug is specifically
in the allocation size, not in the length field itself. The proposed fix
correctly introduces a separate `alloclen = namebuf.length + 1` for the
allocation while preserving `namebuf.length` semantics.

Fixes: dec8d9775ded ("Finish server-side rpc_gss_*() APIs")
Signed-off-by: Olga Kornievskaia <[email protected]>
---
 src/svc_auth_gss.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/svc_auth_gss.c b/src/svc_auth_gss.c
index de2993f..dd7db56 100644
--- a/src/svc_auth_gss.c
+++ b/src/svc_auth_gss.c
@@ -1117,7 +1117,7 @@ rpc_gss_get_principal_name(rpc_gss_principal_t *principal, char *mechanism,
 {
 	OM_uint32 maj_stat, min_stat;
 	rpc_gss_principal_t result;
-	size_t nodelen, secdomlen;
+	size_t nodelen, secdomlen, alloclen;
 	gss_name_t name, mechname;
 	gss_buffer_desc namebuf;
 	rpc_gss_OID oid;
@@ -1135,7 +1135,8 @@ rpc_gss_get_principal_name(rpc_gss_principal_t *principal, char *mechanism,
 	if (secdomain != NULL)
 		secdomlen = strlen(secdomain) + 1;
 	namebuf.length = strlen(user_name) + nodelen + secdomlen;
-	namebuf.value = calloc(1, namebuf.length);
+	alloclen = namebuf.length + 1; /* include terminating NULL for C-string ops */
+	namebuf.value = calloc(1, alloclen);
 	if (namebuf.value == NULL)
 		return FALSE;
 	(void)strcpy(namebuf.value, user_name);
-- 
2.52.0