From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed, 3 Jul 2024 22:49:27 +0200
Subject: [PATCH] smtppass: Correct strncat() invocation.

strncat() expects copies at most length_bytes + 1 therefore the buffer
must be strlen(dest) + strlen(src) + 1 to cover everything.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
---
 common/smtppass.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/common/smtppass.c b/common/smtppass.c
index baa2c558de6a..e28fd890faa9 100644
--- a/common/smtppass.c
+++ b/common/smtppass.c
@@ -1864,12 +1864,15 @@ static void vmessage(spctx_t* ctx, int level, int err,
             
     if(err)
     {
+        int left_bytes;
         /* strerror_r doesn't want to work for us for some reason
         len = strlen(buf);
         strerror_r(e, buf + len, MAX_MSGLEN - len); */
             
         sp_lock();
-            strncat(buf, strerror(e), MAX_MSGLEN);
+            left_bytes = MAX_MSGLEN -1 - strlen(buf) - strlen(strerror(e));
+            if (left_bytes > 0)
+               strncat(buf, strerror(e), left_bytes);
         sp_unlock();
     }
 
-- 
2.45.2

