From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 19 Apr 2017 13:20:11 +0000 (-0400)
Subject: account for trailing zero.  Closes #1960
X-Git-Tag: release_3_0_14~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=404fc843c8356edb32dde27eeddc39b2a224c14f;p=thirdparty%2Ffreeradius-server.git

account for trailing zero.  Closes #1960
---

diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c
index 356038a89ea..a930d6fa1e9 100644
--- a/src/modules/rlm_eap/rlm_eap.c
+++ b/src/modules/rlm_eap/rlm_eap.c
@@ -453,15 +453,24 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, REQUEST *re
 
 		/*
 		 *	Cisco AP1230 has a bug and needs a zero
-		 *	terminated string in Access-Accept.
+		 *	terminated string in Access-Accept.  This
+		 *	means it requires 2 trailing zeros.  One to
+		 *	send in the RADIUS packet, and the other to
+		 *	convince the rest of the server that
+		 *	vp->vp_strvalue is still a NUL-terminated C
+		 *	string.
 		 */
 		if (inst->mod_accounting_username_bug) {
 			char const *old = vp->vp_strvalue;
-			char *new = talloc_zero_array(vp, char, vp->vp_length + 1);
+			char *new;
+
+			vp->vp_length++; /* account for an additional zero */
+
+			new = talloc_array(vp, char, vp->vp_length + 1);
 
 			memcpy(new, old, vp->vp_length);
+			new[vp->length + 1] = '\0';
 			vp->vp_strvalue = new;
-			vp->vp_length++;
 
 			rad_const_free(old);
 		}