Bug 504186

For the sake of completeness - in sendmail, sasl_encode64() is also used in sendmail/srvrsmtp.c.  Buffer to store base64 encoded representation of the authentication string is allocated dynamically.  Size if computed using the ENC64LEN macro, which does not return value that is multiple of 4, and hence sasl_encode64 will always null-terminate or return error.

Uses of sasl_encode64 in sendmail/usersmtp.c are harmless too.  Output buffer to store base64-encoded string - in64 - is only used as an argument to smtpmessage().  in64 can only be missing proper null termination when is got fully filled by sasl_encode64(), i.e. MAXOUTLEN (8192) bytes were written to it.

smtpmessage() accepts printf-like arguments (format string + arguments) and uses sendmail-specific vsnprintf-like function sm_vsnprintf to prepare the output string in the intermediate buffer SmtpMsgBuffer.  Size of the buffer is MAXLINE (2048), hence memory locate after in64 will not be copied it, so memory disclosure is not possible.

Only remaining risk is that in64 is printed to the output buffer using '%s' format, which internally calls strlen on the argument.  This strlen call can over-read in64 buffer, but can not reach far enough to trigger SEGV, as it stops at the first '\0' byte anywhere on the stack above in64 (e.g. main's argc / argv, or area storing args and environment variables located above the stack).

No security implications.