From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Date: Mon, 08 Sep 2008 13:17:05 +0000
Subject: [PATCH] Fix off-by-one in pass_env_to_socket()
Message-Id: <48C525D1.9050401@tuffmail.co.uk>
List-Id: <linux-hotplug.vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: linux-hotplug@vger.kernel.org

This only manifests in exceptional circumstances when the variables exceed
the buffer size.  It can be reproduced as follows:

[kill existing udevd and udevadm]

valgrind -q ./udevd & sleep 1

LONG=`dd if=/dev/zero bs=1 countP0 | tr '\0' 'A'` # 500 character string
for VAR in a b c d; do
	./udevadm control --env $VAR=$LONG
done

./udevadm monitor -e > /dev/null &
./udevadm trigger

[wait a few seconds]

=17942= Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
=17942=    at 0x511BBC3: __sendto_nocancel (in /usr/lib/debug/libc-2.7.so)
=17942=    by 0x407B72: pass_env_to_socket (udev_rules.c:500)
=17942=    by 0x407C7F: udev_rules_run (udev_rules.c:517)
=17942=    by 0x410DDB: udev_event_process (udevd.c:145)
=17942=    by 0x411217: udev_event_run (udevd.c:251)
=17942=    by 0x411E78: msg_queue_manager (udevd.c:581)
=17942=    by 0x413C10: main (udevd.c:1282)
=17942=  Address 0x7fefff0af is on thread 1's stack
...

kill %1 %2

[restart normal udevd]

diff --git a/udev/udev_rules.c b/udev/udev_rules.c
index f372a61..9ed4d62 100644
--- a/udev/udev_rules.c
+++ b/udev/udev_rules.c
@@ -490,8 +490,8 @@ static int pass_env_to_socket(const char *sockpath, const char *devpath, const c
 
 	bufpos = snprintf(buf, sizeof(buf)-1, "%s@%s", action, devpath);
 	bufpos++;
-	for (i = 0; environ[i] != NULL && bufpos < (sizeof(buf)-1); i++) {
-		bufpos += strlcpy(&buf[bufpos], environ[i], sizeof(buf) - bufpos-1);
+	for (i = 0; environ[i] != NULL && bufpos < sizeof(buf); i++) {
+		bufpos += strlcpy(&buf[bufpos], environ[i], sizeof(buf) - bufpos);
 		bufpos++;
 	}
 	if (bufpos > sizeof(buf))