From 7739268e775e6ed91509727b014cc1d367ad386d Mon Sep 17 00:00:00 2001
From: Alexey Melnikov <alexey.melnikov@isode.com>
Date: Sun, 30 Mar 2014 15:13:34 +0100
Subject: When processing a list of mechanism names, we shouldn't allow a short
 prefix match the whole mechanism name

"A", "AN", etc where matching "ANONYMOUS". This patch fixes that.

As reported by plautrba@redhat.com

diff --git a/lib/common.c b/lib/common.c
index e0f59eb..672fe2f 100644
--- a/lib/common.c
+++ b/lib/common.c
@@ -2428,6 +2428,11 @@ int _sasl_is_equal_mech(const char *req_mech,
         *plus = 0;
     }
 
+    if (n < strlen(plug_mech)) {
+	/* Don't allow arbitrary prefix match */
+	return 0;
+    }
+
     return (strncasecmp(req_mech, plug_mech, n) == 0);
 }
 
-- 
cgit v0.10.2