gsasl_client_suggest_mechanism() prefix matching

[Kevin J. McCarthy]

I was looking at how gsasl_client_suggest_mechanism() worked, and 
noticed it seems to accept prefixes matches inside the mechlist 
parameter.

It grabs a valid mechanism using strspn():
  len = strspn (mechlist + i, GSASL_VALID_MECHANISM_CHARACTERS);
and then further below checks:
  if (strncmp (ctx->client_mechs[j].name, mechlist + i, len) == 0)

But this would seem to allow a substring prefix to suggest that 
mechanism.  If that wasn't intended, would it be worth adding another 
check, something like:
  if ((strlen (ctx->client_mechs[j].name) == len) &&
      (strncmp (ctx->client_mechs[j].name, mechlist + i, len) == 0))

Thank you!

-Kevin

signature.asc
Description: PGP signature