>Number:         32877
>Category:       bin
>Synopsis:       mount_procfs(8) doesn't null-terminate cmdline output
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 20 03:35:00 +0000 2006
>Originator:     Geoff C. Wing
>Release:        NetBSD 3.99.15 (2006-02-19)
>Organization:
>Environment:
System: NetBSD g.primenet.com.au 3.99.15 NetBSD 3.99.15 (G) #0: Mon Feb 20 11:34:57 EST 2006 gcw@g.primenet.com.au:/usr/netbsd/src/sys/arch/i386/compile/G i386
Architecture: i386
Machine: i386
>Description:
	mount_procfs(8) manpage say cmdline returns null-terminated strings,
	however the last string is not.  The code explicity removes it.

	A quick test on a Linux system shows the last argument to end in NUL.

	Either we match the manpage, or add extra Linux-emul stuff and change 
	the manpage to indicate both flavours.
>How-To-Repeat:
	Trivial.
>Fix:
--- sys/miscfs/procfs/procfs_cmdline.c.org	2005-12-12 08:55:03.000000000 +1100
+++ sys/miscfs/procfs/procfs_cmdline.c	2006-02-20 14:23:20.000000000 +1100
@@ -84,7 +84,7 @@
 	 * ps(1) would display.
 	 */
 	if (P_ZOMBIE(p) || (p->p_flag & P_SYSTEM) != 0) {
-		len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm);
+		len = snprintf(arg, PAGE_SIZE, "(%s)", p->p_comm) + 1;
 		error = uiomove_frombuf(arg, len, uio);
 
 		free(arg, M_TEMP);
@@ -167,9 +167,6 @@
 				count--;	/* one full string */
 		}
 
-		if (count == 0)
-			i--;		/* exclude the final NUL */
-
 		if (len + i > uio->uio_offset) {
 			/* Have data in this page, copy it out */
 			error = uiomove(arg + uio->uio_offset - len,