From 79a695f24fd19c35a4fe214c42073725dbff1473 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sat, 16 Sep 2017 08:38:28 +0200
Subject: [PATCH 1/2] udev: fix buffer overflow in udev_event_apply_format()

Fixes #6664.
---
 src/udev/udev-event.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
index 601f0ee13d..09f7baf082 100644
--- a/src/udev/udev-event.c
+++ b/src/udev/udev-event.c
@@ -362,7 +362,7 @@ size_t udev_event_apply_format(struct udev_event *event,
                         }
 copy:
                         /* copy char */
-                        if (l == 0)
+                        if (l < 2) /* need space for this char and the terminating NUL */
                                 goto out;
                         s[0] = from[0];
                         from++;
@@ -377,12 +377,12 @@ subst:
                         unsigned int i;
 
                         from++;
-                        for (i = 0; from[i] != '}'; i++) {
+                        for (i = 0; from[i] != '}'; i++)
                                 if (from[i] == '\0') {
                                         log_error("missing closing brace for format '%s'", src);
                                         goto out;
                                 }
-                        }
+
                         if (i >= sizeof(attrbuf))
                                 goto out;
                         memcpy(attrbuf, from, i);
@@ -407,6 +407,7 @@ subst:
         }
 
 out:
+        assert(l >= 1);
         s[0] = '\0';
         return l;
 }

From 61ceaea5c8002bac798f2b8e7b6bc9926ce8f4bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sat, 16 Sep 2017 08:45:02 +0200
Subject: [PATCH 2/2] Move one space from dbus-execute.c to execute.c

The number of spaces is conserved ;)
---
 src/core/dbus-execute.c | 2 +-
 src/core/execute.c      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 86799b13e7..a8cdae5bf2 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -2150,7 +2150,7 @@ int bus_exec_context_set_transient_property(
 
                 m = exec_keyring_mode_from_string(s);
                 if (m < 0)
-                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid key ring mode");
+                        return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid keyring mode");
 
                 if (mode != UNIT_CHECK) {
                         c->keyring_mode = m;
diff --git a/src/core/execute.c b/src/core/execute.c
index 094bb6f7a7..00f709fd80 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2270,7 +2270,7 @@ static int setup_keyring(
                         if (setregid(saved_gid, -1) < 0)
                                 return log_error_errno(errno, "Failed to change GID back for user keyring: %m");
                 }
-       }
+        }
 
         return 0;
 }