From: Jorge Pereira <jpereiran@gmail.com>
Date: Tue, 7 May 2019 02:17:24 +0000 (-0300)
Subject: rlm_couchbase: Fix heap overflow
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bfb0237eb0329f69caf862aadd1d2ec93c86c5aa;p=thirdparty%2Ffreeradius-server.git

rlm_couchbase: Fix heap overflow
---

diff --git a/src/modules/rlm_couchbase/rlm_couchbase.c b/src/modules/rlm_couchbase/rlm_couchbase.c
index b03ecc0d946..8d7d23e356f 100644
--- a/src/modules/rlm_couchbase/rlm_couchbase.c
+++ b/src/modules/rlm_couchbase/rlm_couchbase.c
@@ -451,8 +451,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf)
 		size_t len, i;
 		bool sep = false;
 
-		len = talloc_array_length(inst->server_raw);
-		server = p = talloc_array(inst, char, len);
+		len = talloc_array_length(inst->server_raw) - 1;
+		server = p = talloc_array(inst, char, len + 1);
 		for (i = 0; i < len; i++) {
 			switch (inst->server_raw[i]) {
 			case '\t':