auth/credentials: Fix off-by-one buffer write

If p == pass + 127, assigning to '*++p' writes beyond the array.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index 67644e806e45646f6d4d1661a46bd48595c4271f..917b05a547a6af0f48e66536bca3a3ee940b7696 100644 (file)
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -1556,7 +1556,7 @@ _PUBLIC_ bool cli_credentials_parse_password_fd(struct cli_credentials *credenti
        char pass[128];
 
        for(p = pass, *p = '\0'; /* ensure that pass is null-terminated */
-               p && p - pass < sizeof(pass);) {
+               p && p - pass < sizeof(pass) - 1;) {
                switch (read(fd, p, 1)) {
                case 1:
                        if (*p != '\n' && *p != '\0') {