autofs-5.0.7 - fix several off by one errors

From: Ian Kent <raven@themaw.net>

Fix several off-by-one array reference errors and a couple of short allocation
errors.
---
 daemon/spawn.c         |   10 +++++-----
 lib/defaults.c         |    2 +-
 modules/lookup_ldap.c  |    8 ++++----
 modules/parse_hesiod.c |    2 +-
 modules/parse_sun.c    |    2 +-
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/daemon/spawn.c b/daemon/spawn.c
index 3b4a009..9b8d5a2 100644
--- a/daemon/spawn.c
+++ b/daemon/spawn.c
@@ -320,7 +320,7 @@ int spawn_mount(unsigned logopt, ...)
 	unsigned int retries = MTAB_LOCK_RETRIES;
 	int update_mtab = 1, ret, printed = 0;
 	unsigned int wait = defaults_get_mount_wait();
-	char buf[PATH_MAX];
+	char buf[PATH_MAX + 1];
 
 	/* If we use mount locking we can't validate the location */
 #ifdef ENABLE_MOUNT_LOCKING
@@ -346,7 +346,7 @@ int spawn_mount(unsigned logopt, ...)
 	}
 
 	/* Alloc 1 extra slot in case we need to use the "-f" option */
-	if (!(argv = alloca(sizeof(char *) * argc + 2)))
+	if (!(argv = alloca(sizeof(char *) * (argc + 2))))
 		return -1;
 
 	argv[0] = arg0;
@@ -448,7 +448,7 @@ int spawn_bind_mount(unsigned logopt, ...)
 	unsigned int options;
 	unsigned int retries = MTAB_LOCK_RETRIES;
 	int update_mtab = 1, ret, printed = 0;
-	char buf[PATH_MAX];
+	char buf[PATH_MAX + 1];
 
 	/* If we use mount locking we can't validate the location */
 #ifdef ENABLE_MOUNT_LOCKING
@@ -477,7 +477,7 @@ int spawn_bind_mount(unsigned logopt, ...)
 		}
 	}
 
-	if (!(argv = alloca(sizeof(char *) * argc + 2)))
+	if (!(argv = alloca(sizeof(char *) * (argc + 2))))
 		return -1;
 
 	argv[0] = arg0;
@@ -556,7 +556,7 @@ int spawn_umount(unsigned logopt, ...)
 	unsigned int retries = MTAB_LOCK_RETRIES;
 	int update_mtab = 1, ret, printed = 0;
 	unsigned int wait = defaults_get_umount_wait();
-	char buf[PATH_MAX];
+	char buf[PATH_MAX + 1];
 
 #ifdef ENABLE_MOUNT_LOCKING
 	options = SPAWN_OPT_LOCK;
diff --git a/lib/defaults.c b/lib/defaults.c
index ae1162f..1e89509 100644
--- a/lib/defaults.c
+++ b/lib/defaults.c
@@ -227,7 +227,7 @@ void defaults_free_uris(struct list_head *list)
 static unsigned int add_uris(char *value, struct list_head *list)
 {
 	char *str, *tok, *ptr = NULL;
-	size_t len = strlen(value);
+	size_t len = strlen(value) + 1;
 
 	str = alloca(len);
 	if (!str)
diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
index 83e3215..17cbe9a 100644
--- a/modules/lookup_ldap.c
+++ b/modules/lookup_ldap.c
@@ -2234,8 +2234,8 @@ static int do_get_entries(struct ldap_search_params *sp, struct map_source *sour
 					mapent = new_me;
 					strcat(mapent, " ");
 					strncat(mapent, v_val, v_len);
-					mapent[new_size] = '\0';
-					mapent_len = new_size;
+					mapent[new_size - 1] = '\0';
+					mapent_len = new_size - 1;
 				} else {
 					char *estr;
 					estr = strerror_r(errno, buf, sizeof(buf));
@@ -2723,8 +2723,8 @@ static int lookup_one(struct autofs_point *ap,
 					mapent = new_me;
 					strcat(mapent, " ");
 					strncat(mapent, v_val, v_len);
-					mapent[new_size] = '\0';
-					mapent_len = new_size;
+					mapent[new_size - 1] = '\0';
+					mapent_len = new_size - 1;
 				} else {
 					char *estr;
 					estr = strerror_r(errno, buf, sizeof(buf));
diff --git a/modules/parse_hesiod.c b/modules/parse_hesiod.c
index 7a6a57d..237fd50 100644
--- a/modules/parse_hesiod.c
+++ b/modules/parse_hesiod.c
@@ -117,7 +117,7 @@ static int parse_nfs(struct autofs_point *ap,
 		p++;
 
 	/* Isolate the remote mountpoint for this NFS fs. */
-	for (i = 0; (!isspace(p[i]) && i < (int) sizeof(mount)); i++) {
+	for (i = 0; (!isspace(p[i]) && i < ((int) sizeof(mount) - 1)); i++) {
 		if (!p[i]) {
 			error(ap->logopt, MODPREFIX
 			      "unexpeced end of input looking for NFS "
diff --git a/modules/parse_sun.c b/modules/parse_sun.c
index ae1caf7..c1fc528 100644
--- a/modules/parse_sun.c
+++ b/modules/parse_sun.c
@@ -1135,7 +1135,7 @@ static int mount_subtree(struct autofs_point *ap, struct mapent *me,
 			}
 			ro_len = strlen(ro_loc);
 
-			tmp = alloca(mnt_root_len + 1);
+			tmp = alloca(mnt_root_len + 2);
 			strcpy(tmp, mnt_root);
 			tmp[mnt_root_len] = '/';
 			tmp[mnt_root_len + 1] = '\0';