Zero-terminate value returned by modsso_session_deserialize

src/mod_sso/session.c

@@ -111,6 +111,8 @@ int modsso_session_deserialize(apr_pool_t *pool, const unsigned char *key,
                         (const unsigned char *)enc_value, i) != 0) {
     return -1;
   }
+  // Zero-terminate value, as we'll be using it as a string later.
+  (*value)[*value_len] = '\0';
 
   signature_len = strlen(enc_signature);
   signature = apr_palloc(pool, signature_len + 1);

src/sso/base64.c

@@ -121,6 +121,8 @@ int sso_base64_encode(unsigned char *dst, size_t *dlen,
  * Decode a base64-formatted buffer.
  *
  * Supports both standard and "web-safe" encodings.
+ *
+ * The destination buffer is *not* zero-terminated.
  */
 int sso_base64_decode(unsigned char *dst, size_t *dlen,
                       const unsigned char *src, size_t slen) {