2 files changed, 10 insertions, 4 deletions

diff --git a/ChangeLog b/ChangeLog
index 017c05a73..b8108d92f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20131229
+ - (djm) [loginrec.c] Check for username truncation when looking up lastlog
+   entries
+
 20131221
  - (dtucker) [regress/keytype.sh] Actually test ecdsa key types.
 
diff --git a/loginrec.c b/loginrec.c
index 59e8a44ee..8844db540 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -310,9 +310,12 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
                 fatal("%s: Cannot find account for uid %ld", __func__,
                     (long)uid);
 
-        /* No MIN_SIZEOF here - we absolutely *must not* truncate the
-         * username (XXX - so check for trunc!) */
-        strlcpy(li->username, pw->pw_name, sizeof(li->username));
+        if (strlcpy(li->username, pw->pw_name, sizeof(li->username)) >=
+            sizeof(li->username)) {
+                error("%s: username too long (%lu > max %lu)", __func__,
+                    strlen(pw->pw_name), sizeof(li->username) - 1);
+                return NULL;
+        }
 
         if (getlast_entry(li))
                 return (li);
@@ -320,7 +323,6 @@ login_get_lastlog(struct logininfo *li, const uid_t uid)
                 return (NULL);
 }
 
-
 /*
  * login_alloc_entry(int, char*, char*, char*)    - Allocate and initialise
  *                                                  a logininfo structure