rlm_couchbase: Fix heap overflow

diff --git a/src/modules/rlm_couchbase/rlm_couchbase.c b/src/modules/rlm_couchbase/rlm_couchbase.c
index b03ecc0d946f45fc6092db0ed60a7aa6cd825a9b..8d7d23e356f09708f4ff3bc46ec0a26fa7ef662d 100644 (file)
--- a/src/modules/rlm_couchbase/rlm_couchbase.c
+++ b/src/modules/rlm_couchbase/rlm_couchbase.c
@@ -451,8 +451,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf)
                size_t len, i;
                bool sep = false;
 
-               len = talloc_array_length(inst->server_raw);
-               server = p = talloc_array(inst, char, len);
+               len = talloc_array_length(inst->server_raw) - 1;
+               server = p = talloc_array(inst, char, len + 1);
                for (i = 0; i < len; i++) {
                        switch (inst->server_raw[i]) {
                        case '\t':