autofs-5.0.7 - fix several off by one errors

From: Ian Kent <raven@themaw.net>

Fix several off-by-one array reference errors and a couple of short allocation

errors.

---

 daemon/spawn.c         |   10 +++++-----

 lib/defaults.c         |    2 +-

 modules/lookup_ldap.c  |    8 ++++----

 modules/parse_hesiod.c |    2 +-

 modules/parse_sun.c    |    2 +-

 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/daemon/spawn.c b/daemon/spawn.c

index 3b4a009..9b8d5a2 100644

--- a/daemon/spawn.c

+++ b/daemon/spawn.c

@@ -320,7 +320,7 @@ int spawn_mount(unsigned logopt, ...)

 	unsigned int retries = MTAB_LOCK_RETRIES;

 	int update_mtab = 1, ret, printed = 0;

 	unsigned int wait = defaults_get_mount_wait();

-	char buf[PATH_MAX];

+	char buf[PATH_MAX + 1];

 	/* If we use mount locking we can't validate the location */

 #ifdef ENABLE_MOUNT_LOCKING

@@ -346,7 +346,7 @@ int spawn_mount(unsigned logopt, ...)

 	}

 	/* Alloc 1 extra slot in case we need to use the "-f" option */

-	if (!(argv = alloca(sizeof(char *) * argc + 2)))

+	if (!(argv = alloca(sizeof(char *) * (argc + 2))))

 		return -1;

 	argv[0] = arg0;

@@ -448,7 +448,7 @@ int spawn_bind_mount(unsigned logopt, ...)

 	unsigned int options;

 	unsigned int retries = MTAB_LOCK_RETRIES;

 	int update_mtab = 1, ret, printed = 0;

-	char buf[PATH_MAX];

+	char buf[PATH_MAX + 1];

 	/* If we use mount locking we can't validate the location */

 #ifdef ENABLE_MOUNT_LOCKING

@@ -477,7 +477,7 @@ int spawn_bind_mount(unsigned logopt, ...)

 		}

 	}

-	if (!(argv = alloca(sizeof(char *) * argc + 2)))

+	if (!(argv = alloca(sizeof(char *) * (argc + 2))))

 		return -1;

 	argv[0] = arg0;

@@ -556,7 +556,7 @@ int spawn_umount(unsigned logopt, ...)

 	unsigned int retries = MTAB_LOCK_RETRIES;

 	int update_mtab = 1, ret, printed = 0;

 	unsigned int wait = defaults_get_umount_wait();

-	char buf[PATH_MAX];

+	char buf[PATH_MAX + 1];

 #ifdef ENABLE_MOUNT_LOCKING

 	options = SPAWN_OPT_LOCK;

diff --git a/lib/defaults.c b/lib/defaults.c

index ae1162f..1e89509 100644

--- a/lib/defaults.c

+++ b/lib/defaults.c

@@ -227,7 +227,7 @@ void defaults_free_uris(struct list_head *list)

 static unsigned int add_uris(char *value, struct list_head *list)

 {

 	char *str, *tok, *ptr = NULL;

-	size_t len = strlen(value);

+	size_t len = strlen(value) + 1;

 	str = alloca(len);

 	if (!str)

diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c

index 83e3215..17cbe9a 100644

--- a/modules/lookup_ldap.c

+++ b/modules/lookup_ldap.c

@@ -2234,8 +2234,8 @@ static int do_get_entries(struct ldap_search_params *sp, struct map_source *sour

 					mapent = new_me;

 					strcat(mapent, " ");

 					strncat(mapent, v_val, v_len);

-					mapent[new_size] = '\0';

-					mapent_len = new_size;

+					mapent[new_size - 1] = '\0';

+					mapent_len = new_size - 1;

 				} else {

 					char *estr;

 					estr = strerror_r(errno, buf, sizeof(buf));

@@ -2723,8 +2723,8 @@ static int lookup_one(struct autofs_point *ap,

 					mapent = new_me;

 					strcat(mapent, " ");

 					strncat(mapent, v_val, v_len);

-					mapent[new_size] = '\0';

-					mapent_len = new_size;

+					mapent[new_size - 1] = '\0';

+					mapent_len = new_size - 1;

 				} else {

 					char *estr;

 					estr = strerror_r(errno, buf, sizeof(buf));

diff --git a/modules/parse_hesiod.c b/modules/parse_hesiod.c

index 7a6a57d..237fd50 100644

--- a/modules/parse_hesiod.c

+++ b/modules/parse_hesiod.c

@@ -117,7 +117,7 @@ static int parse_nfs(struct autofs_point *ap,

 		p++;

 	/* Isolate the remote mountpoint for this NFS fs. */

-	for (i = 0; (!isspace(p[i]) && i < (int) sizeof(mount)); i++) {

+	for (i = 0; (!isspace(p[i]) && i < ((int) sizeof(mount) - 1)); i++) {

 		if (!p[i]) {

 			error(ap->logopt, MODPREFIX

 			      "unexpeced end of input looking for NFS "

diff --git a/modules/parse_sun.c b/modules/parse_sun.c

index ae1caf7..c1fc528 100644

--- a/modules/parse_sun.c

+++ b/modules/parse_sun.c

@@ -1135,7 +1135,7 @@ static int mount_subtree(struct autofs_point *ap, struct mapent *me,

 			}

 			ro_len = strlen(ro_loc);

-			tmp = alloca(mnt_root_len + 1);

+			tmp = alloca(mnt_root_len + 2);

 			strcpy(tmp, mnt_root);

 			tmp[mnt_root_len] = '/';

 			tmp[mnt_root_len + 1] = '\0';