Apache module uses strings without null termination

[Mark Donnelly]

The Apache module often uses strings out of a gss_buffer under the assumption that it's null-terminated when there's no guarantee of that. An example of this is:

gss_log(APLOG_MARK, APLOG_DEBUG, 0, r, "Acquiring creds for %s", token.value);

Another example of this is within the get_gss_error() function:
   do {
      maj_stat = gss_display_status (&min_stat,
                              err_min,
         GSS_C_MECH_CODE,
         GSS_C_NULL_OID,
         &msg_ctx,
         &status_string);
      if (!GSS_ERROR(maj_stat)) {
  err_msg = apr_pstrcat(r->pool, err_msg,
          (first_pass) ? "" : ", ",
                        (char *) status_string.value,
          NULL);
  gss_release_buffer(&min_stat, &status_string);
  first_pass = 0;
      }
   } while (!GSS_ERROR(maj_stat) && msg_ctx != 0);

Any time a string is incorrectly assumed to be null-terminated is a potential security problem.

[Margaret Cullen (mrw42)]

We should confirm that the gss code is not null terminating these strings.