Patch origin: in-house
This is a non-vulnerability Parfait error.
Filed as https://bugzilla.cyrusimap.org/show_bug.cgi?id=3934

diff -rupN old/saslauthd/auth_httpform.c new/saslauthd/auth_httpform.c
--- old/saslauthd/auth_httpform.c	2016-05-03 18:40:11.701189626 -0700
+++ new/saslauthd/auth_httpform.c	2016-05-03 18:42:47.344382759 -0700
@@ -85,6 +85,10 @@
 #define MAX(p,q) ((p >= q) ? p : q)
 #endif
 
+#ifndef MIN
+#define MIN(p,q) ((p <= q) ? p : q)
+#endif
+
 /* PRIVATE DEPENDENCIES */
 static cfile config = NULL;
 static const char *r_host = "localhost";  /* remote host (mech_option) */
@@ -612,11 +616,13 @@ auth_httpform (
         return strdup(RESP_IERROR);
     }
 
+    rc = MIN(rc, RESP_LEN - 1);  /* don't write past rbuf */
+    rbuf[rc] = '\0';             /* make sure str-funcs find null */
+
     if (flags & VERBOSE) {
         syslog(LOG_DEBUG, "auth_httpform: [%s] %s", user, rbuf);
     }
 
-    rbuf[rc] = '\0';             /* make sure str-funcs find null */
     return build_sasl_response(rbuf);
 }