libpam migauthhandler buffers (#312)

A few corrections to prevent buffer overflow in the libpam
migauthhandler

Author: Martin-Rehr

mig/src/libpam-mig/migauthhandler.c

@@ -368,9 +368,9 @@ static bool mig_reg_auth_attempt(const unsigned int mode,
         /* We don't exit hard here to make sure other auth types may follow */
         return false;
     }
-    char pycmd[MAX_PYCMD_LENGTH] =
+    /* NOTE: Allocate space for string terminator '\0' added by strncat after concatenation */
+    char pycmd[MAX_PYCMD_LENGTH+1] =
         "(authorized, disconnect) = validate_auth_attempt(configuration, 'sftp-subsys', ";
-    char pytmp[MAX_PYCMD_LENGTH];
     /* Always password auth here as mentioned in the above comment */
     strncat(&pycmd[0], "'password', ", MAX_PYCMD_LENGTH - strlen(pycmd));
 
@@ -380,8 +380,9 @@ static bool mig_reg_auth_attempt(const unsigned int mode,
     strncat(&pycmd[0], address, MAX_PYCMD_LENGTH - strlen(pycmd));
     strncat(&pycmd[0], "', ", MAX_PYCMD_LENGTH - strlen(pycmd));
     if (secret != NULL) {
-        sprintf(&pytmp[0], "secret='%s', ", secret);
-        strncat(&pycmd[0], &pytmp[0], MAX_PYCMD_LENGTH - strlen(pycmd));
+        strncat(&pycmd[0], "secret='", MAX_PYCMD_LENGTH - strlen(pycmd));
+        strncat(&pycmd[0], secret, MAX_PYCMD_LENGTH - strlen(pycmd));
+        strncat(&pycmd[0], "', ", MAX_PYCMD_LENGTH - strlen(pycmd));
     }
     if (mode & MIG_INVALID_USERNAME) {
         strncat(&pycmd[0], "invalid_username=True, ",
@@ -444,7 +445,12 @@ static bool mig_reg_auth_attempt(const unsigned int mode,
                 MAX_PYCMD_LENGTH - strlen(pycmd));
     }
     strncat(&pycmd[0], ")", MAX_PYCMD_LENGTH - strlen(pycmd));
-    /* Execute python command if and only if it didn't overflow */
+    /* Execute python command if and only if it didn't overflow 
+     * NOTE: Since we can't check if pycmd was truncated by strncat 
+     *       or if we actually got a command string length of MAX_PYCMD_LENGTH
+     *       we cap the maximum allowed command string length to MAX_PYCMD_LENGTH-1
+     *       (MAX_PYCMD_LENGTH including the terminator '\0')
+    */
     if (MAX_PYCMD_LENGTH > strlen(pycmd)) {
         pyrun(&pycmd[0]);
         PyObject *py_authorized = PyObject_GetAttrString(py_main, "authorized");