9b20bca
Surely "buf[strlen(buf)] = '\0'" doesn't do what we intend.  RT#6521
d8d4a3c
d8d4a3c
diff -up krb5-1.7/src/appl/gssftp/ftp/ftp.c krb5-1.7/src/appl/gssftp/ftp/ftp.c
d8d4a3c
--- krb5-1.7/src/appl/gssftp/ftp/ftp.c	2009-06-22 16:03:48.000000000 -0400
d8d4a3c
+++ krb5-1.7/src/appl/gssftp/ftp/ftp.c	2009-06-22 16:06:28.000000000 -0400
d8d4a3c
@@ -1663,21 +1663,21 @@ void pswitch(int flag)
d8d4a3c
 	ip->ntflg = ntflag;
d8d4a3c
 	ntflag = op->ntflg;
d8d4a3c
 	(void) strncpy(ip->nti, ntin, sizeof(ip->nti) - 1);
d8d4a3c
-	(ip->nti)[strlen(ip->nti)] = '\0';
d8d4a3c
+	(ip->nti)[sizeof(ip->nti) - 1] = '\0';
d8d4a3c
 	(void) strncpy(ntin, op->nti, sizeof(ntin) - 1);
d8d4a3c
 	ntin[sizeof(ntin) - 1] = '\0';
d8d4a3c
 	(void) strncpy(ip->nto, ntout, sizeof(ip->nto) - 1);
d8d4a3c
-	(ip->nto)[strlen(ip->nto)] = '\0';
d8d4a3c
+	(ip->nto)[sizeof(ip->nto) - 1] = '\0';
d8d4a3c
 	(void) strncpy(ntout, op->nto, sizeof(ntout) - 1);
d8d4a3c
 	ntout[sizeof(ntout) - 1] = '\0';
d8d4a3c
 	ip->mapflg = mapflag;
d8d4a3c
 	mapflag = op->mapflg;
d8d4a3c
-	(void) strncpy(ip->mi, mapin, MAXPATHLEN - 1);
d8d4a3c
-	(ip->mi)[strlen(ip->mi)] = '\0';
d8d4a3c
+	(void) strncpy(ip->mi, mapin, sizeof(ip->mi) - 1);
d8d4a3c
+	(ip->mi)[sizeof(ip->mi) - 1] = '\0';
d8d4a3c
 	(void) strncpy(mapin, op->mi, sizeof(mapin) - 1);
d8d4a3c
 	mapin[sizeof(mapin) - 1] = '\0';
d8d4a3c
-	(void) strncpy(ip->mo, mapout, MAXPATHLEN - 1);
d8d4a3c
-	(ip->mo)[strlen(ip->mo)] = '\0';
d8d4a3c
+	(void) strncpy(ip->mo, mapout, sizeof(ip->mo) - 1);
d8d4a3c
+	(ip->mo)[sizeof(ip->mo) - 1] = '\0';
d8d4a3c
 	(void) strncpy(mapout, op->mo, sizeof(mapout) - 1);
d8d4a3c
 	mapout[sizeof(mapout) - 1] = '\0';
d8d4a3c
 	ip->authtype = auth_type;