The openssl command line tool treats the non-null terminated buffer

"mbuf" as a C string when using the pop3 s_client feature. This causes
a segmentation fault with malloc.conf option "J" set when BIO_printf()
runs off the end of the buffer. The following patch fixes PR 6282
from Matthew Haub (asked to submit upstream), ok djm

1 files changed, 1 insertions, 1 deletions

diff --git a/src/lib/libssl/src/apps/s_client.c b/src/lib/libssl/src/apps/s_client.c
index 70e7254a91..5bbad0e1e6 100644
--- a/src/lib/libssl/src/apps/s_client.c
+++ b/src/lib/libssl/src/apps/s_client.c
@@ -1074,7 +1074,7 @@ SSL_set_tlsext_status_ids(con, ids);
 
                                 if (starttls_proto)
                                         {
-                                        BIO_printf(bio_err,"%s",mbuf);
+                                        BIO_write(bio_err, mbuf, mbuf_len);
                                         /* We don't need to know any more */
                                         starttls_proto = PROTO_OFF;
                                         }