Make sure that the output of X509_NAME_oneline is null-terminated.

diff --git a/mutt_ssl.c b/mutt_ssl.c
index f16215fb687d540bbb3e1df473f975e88a7eacb3..01ab7b8c5c7884478a1f416011c2e266fba541ad 100644 (file)
--- a/mutt_ssl.c
+++ b/mutt_ssl.c
@@ -982,9 +982,10 @@ static int ssl_check_certificate (CONNECTION *conn, sslsockdata *data)
 #ifdef DEBUG
   char buf[STRING];
 
+  buf[STRING - 1] = '\0';
   dprint (1, (debugfile, "ssl_check_certificate: checking cert %s\n",
               X509_NAME_oneline (X509_get_subject_name (data->cert),
-                                 buf, sizeof (buf))));
+                                 buf, sizeof (buf) - 1)));
 #endif
 
   if ((preauthrc = ssl_check_preauth (data->cert, conn->account.host)) > 0)
@@ -1004,7 +1005,7 @@ static int ssl_check_certificate (CONNECTION *conn, sslsockdata *data)
 
     dprint (1, (debugfile, "ssl_check_certificate: checking cert chain entry %s\n",
                 X509_NAME_oneline (X509_get_subject_name (cert),
-                                   buf, sizeof (buf))));
+                                   buf, sizeof (buf) - 1)));
 
     /* if the certificate validates or is manually accepted, then add it to
      * the trusted set and recheck the peer certificate */