Null-terminate buffer in mbx_copy() in dropsbr.c. Noticed by

[nmh] / mts / smtp / smtp.c

diff --git a/mts/smtp/smtp.c b/mts/smtp/smtp.c
index 231bdaef38fadc7f2492b278a7f6d5a637e5b8a6..7177e5d59ea330f086a2323f4576dcbb0042980f 100644 (file)
--- a/mts/smtp/smtp.c
+++ b/mts/smtp/smtp.c
@@ -854,11 +854,12 @@ sm_auth_sasl(char *user, int saslssf, char *mechlist, char *inhost)
        strncpy(host, inhost, sizeof(host) - 1);
     }
 
-    callbacks[SM_SASL_N_CB_USER].context = user;
-    callbacks[SM_SASL_N_CB_AUTHNAME].context = user;
-
-    nmh_get_credentials (host, user, 1, &creds);
+    nmh_get_credentials (host, user, 0, &creds);
 
+    /* It's OK to copy the creds pointers here.  The callbacks that
+       use them will only be called before this function returns. */
+    callbacks[SM_SASL_N_CB_USER].context = creds.user;
+    callbacks[SM_SASL_N_CB_AUTHNAME].context = creds.user;
     sasl_pw_context[0] = host;
     sasl_pw_context[1] = creds.user;
     sasl_pw_context[2] = creds.password;