diff --git a/cyrus-sasl-2.1.22-encode64.patch b/cyrus-sasl-2.1.22-encode64.patch
new file mode 100644
index 0000000..7dd9e21
--- /dev/null
+++ b/cyrus-sasl-2.1.22-encode64.patch
@@ -0,0 +1,30 @@
+--- cyrus-sasl-2.1.22/lib/saslutil.c	2009/04/17 06:04:50	1.48
++++ cyrus-sasl-2.1.22/lib/saslutil.c	2009/04/27 13:26:27	1.49
+@@ -1,7 +1,7 @@
+ /* saslutil.c
+  * Rob Siemborski
+  * Tim Martin
+- * $Id: saslutil.c,v 1.44 2006/03/13 18:26:36 mel Exp $
++ * $Id: saslutil.c,v 1.49 2009/04/27 13:26:27 murch Exp $
+  */
+ /* 
+  * Copyright (c) 1998-2003 Carnegie Mellon University.  All rights reserved.
+@@ -127,7 +127,7 @@
+     olen = (inlen + 2) / 3 * 4;
+     if (outlen)
+       *outlen = olen;
+-    if (outmax < olen)
++    if (outmax <= olen)
+       return SASL_BUFOVER;
+ 
+     /* Do the work... */
+@@ -151,8 +151,7 @@
+         *out++ = '=';
+     }
+ 
+-    if (olen < outmax)
+-      *out = '\0';
++    *out = '\0';
+     
+     return SASL_OK;
+ }
diff --git a/cyrus-sasl.spec b/cyrus-sasl.spec
index dbc5a41..4ea2522 100644
--- a/cyrus-sasl.spec
+++ b/cyrus-sasl.spec
@@ -4,7 +4,7 @@
 Summary: The Cyrus SASL library
 Name: cyrus-sasl
 Version: 2.1.22
-Release: 23%{?dist}
+Release: 24%{?dist}
 License: BSD
 Group: System Environment/Libraries
 # Source0 originally comes from ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/;
@@ -31,6 +31,7 @@ Patch32: cyrus-sasl-2.1.22-warnings.patch
 Patch33: cyrus-sasl-2.1.22-current-db.patch
 Patch34: cyrus-sasl-2.1.22-ldap-timeout.patch
 Patch35: cyrus-sasl-2.1.22-bad-elif.patch
+Patch36: cyrus-sasl-2.1.22-encode64.patch
 
 Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: autoconf, automake, libtool, gdbm-devel, groff
@@ -142,6 +143,7 @@ chmod -x include/*.h
 %patch33 -p1 -b .current-db
 %patch34 -p1 -b .ldap-timeout
 %patch35 -p1 -b .elif
+%patch36 -p1 -b .encode64
 
 # FIXME - we remove these files directly so that we can avoid using the -f
 # flag, which has a nasty habit of overwriting files like COPYING.
@@ -372,6 +374,9 @@ fi
 %{_sbindir}/sasl2-shared-mechlist
 
 %changelog
+* Mon May 11 2009 Jan Chadima <jchadima@redhat.com> - 2.1.22-24
+- repair sasl_encode64 nul termination (#487251)
+
 * Thu Apr 16 2009 Robert Scheck <robert@fedoraproject.org> - 2.1.22-23
 - Don't build the krb4 plugin as krb5 1.7 will drop it (#225974 #c6)