Out-of-bounds stack read in auth_gssapi_client.c:parse_server_packet() due to missing NUL-termination and invalid boundary checks

Two distinct parsing flaws in plugins/auth/auth_gssapi_client.c lead to out-of-bounds reads when processing a server-supplied authentication packet.

Flaw 1: Unterminated SPN Buffer (OOB Read):

In parse_server_packet(), strncpy(spn, packet, PRINCIPAL_NAME_MAX) is used to copy the server-supplied Service Principal Name (SPN). When a server sends an SPN of 256 bytes or more without a NUL byte, strncpy() fills the destination buffer without writing a trailing NUL terminator.

Subsequent invocation of strlen(principal_name) inside auth_client() reads past the allocated stack buffer until hitting an arbitrary zero byte on the stack.

Flaw 2: Mechanism Copy Reading Past Packet Boundary:

When the authentication packet contains no NUL byte, strnlen(packet, packet_len) returns packet_len.

The condition if (spn_len == packet_len - 1) evaluates to false (packet_len == packet_len - 1), causing execution to enter the else branch. The driver then executes strncpy(mech, packet + spn_len + 1, MECH_NAME_MAX), reading from one byte past the end of the packet buffer (packet + packet_len + 1).

This issue was reported by AISLE research