From: David Michael <fedora.dm0@gmail.com>
Date: Sun, 23 Oct 2022 22:51:33 +0000 (-0400)
Subject: useradd: Fix buffer overflow when using a prefix
X-Git-Tag: 4.13~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eaebea55a495a56317ed85e959b3599f73c6bdf2;p=thirdparty%2Fshadow.git

useradd: Fix buffer overflow when using a prefix

The buffer length did not count the string's trailing null byte.

Signed-off-by: David Michael <fedora.dm0@gmail.com>
---

diff --git a/src/useradd.c b/src/useradd.c
index 39a744ee0..7ea0a9c4d 100644
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -2372,7 +2372,7 @@ static void create_mail (void)
 		if (NULL == spool) {
 			return;
 		}
-		file = alloca (strlen (prefix) + strlen (spool) + strlen (user_name) + 2);
+		file = alloca (strlen (prefix) + strlen (spool) + strlen (user_name) + 3);
 		if (prefix[0])
 			sprintf (file, "%s/%s/%s", prefix, spool, user_name);
 		else