From 7a2b302e68a4f3e324b851c7361e40aa20a86a64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
Date: Thu, 2 Mar 2023 16:18:45 +0100
Subject: [PATCH] usermod: fix off-by-one issues

Allocate enough memory for the strings, two slashes and the NUL
terminator.

Reported-by: Alejandro Colomar <alx@kernel.org>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
---
 src/usermod.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/usermod.c b/src/usermod.c
index 77d4ef49..db5d37a4 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -2048,7 +2048,7 @@ static void move_mailbox (void)
 	if (NULL == maildir) {
 		return;
 	}
-	len = strlen (prefix) + strlen (maildir) + strlen (user_name) + 2;
+	len = strlen (prefix) + strlen (maildir) + strlen (user_name) + 3;
	mailfile = alloca (len);
 
 	/*
@@ -2103,7 +2103,7 @@ static void move_mailbox (void)
 	(void) close (fd);
 
 	if (lflg) {
-		len = strlen (prefix) + strlen (maildir) + strlen (user_newname) + 2;
+		len = strlen (prefix) + strlen (maildir) + strlen (user_newname) + 3;
 		newmailfile = alloca(len);
 		if (prefix[0]) {
 			(void) snprintf (newmailfile, len, "%s/%s/%s",
-- 
2.27.0

