When a hostname fills cron's fixed-size buffer, the mail-output path
can treat it as a NUL-terminated string even though gethostname() did
not supply a terminator. An AddressSanitizer harness reproduced a read
past the buffer. The relevant conditions are a maximum-length
administrator-controlled hostname, job output, and mail delivery. We
have not demonstrated a useful information leak or a production crash.

The attached Debian -212 patch reserves room for termination, checks
gethostname()'s return value, and uses a safe fallback on error. Its
regression test covers ordinary success, error, and a successful
full-buffer result without a NUL terminator.

The patched Debian source built in a disposable trixie container; the
focused regression and all 13 existing Debian integration tests
passed. Ubuntu versions 3.0pl1-200ubuntu1 and -209ubuntu1 have the
same issue. Debian and Ubuntu Security Teams recommended public bug
reports.

Regards,
Brett Sutton