Fix handling of zero-length server banners (thanks, Tomas Mraz; closes:

#497026).

1 files changed, 3 insertions, 2 deletions

diff --git a/sshconnect2.c b/sshconnect2.c
index 18cbbd9f9..185e7b204 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -441,8 +441,9 @@ input_userauth_banner(int type, u_int32_t seq, void *ctxt)
         if (options.log_level >= SYSLOG_LEVEL_INFO) {
                 if (len > 65536)
                         len = 65536;
-                msg = xmalloc(len * 4); /* max expansion from strnvis() */
-                strnvis(msg, raw, len * 4, VIS_SAFE|VIS_OCTAL);
+                msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
+                strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL);
+                msg[len*4] = '\0';
                 fprintf(stderr, "%s", msg);
                 xfree(msg);
         }