util_create_path(): fix possible out of bounds array access

[elogind.git] / libudev / libudev-util-private.c

diff --git a/libudev/libudev-util-private.c b/libudev/libudev-util-private.c
index b33ee79d6b4f110d7caae3f44955886322f6f360..fe8f29b3a89007e20b595a73693644e4b18484ca 100644 (file)
--- a/libudev/libudev-util-private.c
+++ b/libudev/libudev-util-private.c
@@ -30,15 +30,16 @@ int util_create_path(struct udev *udev, const char *path)
        char p[UTIL_PATH_SIZE];
        char *pos;
        struct stat stats;
-       int ret;
+       int err;
 
        util_strscpy(p, sizeof(p), path);
        pos = strrchr(p, '/');
-       if (pos == p || pos == NULL)
+       if (pos == NULL)
                return 0;
-
-       while (pos[-1] == '/')
+       while (pos != p && pos[-1] == '/')
                pos--;
+       if (pos == p)
+               return 0;
        pos[0] = '\0';
 
        dbg(udev, "stat '%s'\n", p);
@@ -50,15 +51,12 @@ int util_create_path(struct udev *udev, const char *path)
 
        dbg(udev, "mkdir '%s'\n", p);
        udev_selinux_setfscreatecon(udev, p, S_IFDIR|0755);
-       ret = mkdir(p, 0755);
-       udev_selinux_resetfscreatecon(udev);
-       if (ret == 0)
-               return 0;
-
-       if (errno == EEXIST)
+       err = mkdir(p, 0755);
+       if (err != 0 && errno == EEXIST)
                if (stat(p, &stats) == 0 && (stats.st_mode & S_IFMT) == S_IFDIR)
-                       return 0;
-       return -1;
+                       err = 0;
+       udev_selinux_resetfscreatecon(udev);
+       return err;
 }
 
 int util_delete_path(struct udev *udev, const char *path)
@@ -67,6 +65,9 @@ int util_delete_path(struct udev *udev, const char *path)
        char *pos;
        int retval;
 
+       if (path[0] == '/')
+               while(path[1] == '/')
+                       path++;
        util_strscpy(p, sizeof(p), path);
        pos = strrchr(p, '/');
        if (pos == p || pos == NULL)