I wrote:
> Hmph. I can't reproduce this on RHEL8: so far as I can tell, the string
> is physically null-terminated, and clang's address sanitizer doesn't
> complain either. Still, given the vagueness of the spec for
> gss_display_status, it seems wise to not assume that every GSS
> implementation acts the same.
I've committed fixes to make our code rely on the returned length
field instead. Hopefully that won't expose any new bugs in other
GSS implementations :-(
regards, tom lane