Firstly, I pulled the sources from upstream and compiled them against a kernel I
have.  So, sorry if this is fixed in the rpm.

Description of problem:
The substr function, as described in the man page and comments, indicates the
last argument is the "stop", however, the strncpy function acts as though it
expects it to be a "length" argument.

If I want "there" from "hello there world", it currently does the following:
str = "hello there world"
substr(str, 6, 11) # 11 is the stop, not the len
-> strncpy(ret, s+6, 11)
-> ret[11] = '\0'
result:  "there world"

should be:
str = "hello there world"
substr(str, 6, 11) # 11 is the stop, not the len
-> strncpy(ret, s+6, 11-6)
-> ret[11-6] = '\0'
result:  "there"

Version-Release number of selected component (if applicable):
?

How reproducible:
always

Steps to Reproduce:
See above

I am using the following (please review for correctness):
strncpy(THIS->__retvalue,s+THIS->start, THIS->stop - THIS->start);
THIS->__retvalue[THIS->stop - THIS->start]='\0';