openssl s_client: avoid two out of bounds writes

A NUL termination after an unchecked BIO_read() call in XMSS mode could
lead to a write one byte before the start of sbuf or one past its end.
Add an error check to avoid the former and read one byte less to avoid the
latter.

Found by Frank Denis

1 files changed, 4 insertions, 2 deletions

diff --git a/src/usr.bin/openssl/s_client.c b/src/usr.bin/openssl/s_client.c
index 2b05facc17..00b6f7178a 100644
--- a/src/usr.bin/openssl/s_client.c
+++ b/src/usr.bin/openssl/s_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s_client.c,v 1.68 2026/02/01 08:45:31 martijn Exp $ */
+/* $OpenBSD: s_client.c,v 1.69 2026/05/09 14:16:37 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1314,7 +1314,9 @@ s_client_main(int argc, char **argv)
                 }
                 BIO_printf(sbio,
                     "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>");
-                seen = BIO_read(sbio, sbuf, BUFSIZZ);
+                seen = BIO_read(sbio, sbuf, BUFSIZZ - 1);
+                if (seen <= 0)
+                        goto shut;
                 sbuf[seen] = 0;
                 if (!strstr(sbuf, "<proceed"))
                         goto shut;