util_create_path(): fix possible out of bounds array access

diff --git a/libudev/libudev-util-private.c b/libudev/libudev-util-private.c
index 042b711928add19cff5ab34145d9f519e280e89e..fe8f29b3a89007e20b595a73693644e4b18484ca 100644 (file)
--- a/libudev/libudev-util-private.c
+++ b/libudev/libudev-util-private.c
@@ -34,11 +34,12 @@ int util_create_path(struct udev *udev, const char *path)
 
        util_strscpy(p, sizeof(p), path);
        pos = strrchr(p, '/');
 
        util_strscpy(p, sizeof(p), path);
        pos = strrchr(p, '/');

-       if (pos == p || pos == NULL)
+       if (pos == NULL)

                return 0;
                return 0;

-
-       while (pos[-1] == '/')
+       while (pos != p && pos[-1] == '/')

                pos--;
                pos--;

+       if (pos == p)
+               return 0;

        pos[0] = '\0';
 
        dbg(udev, "stat '%s'\n", p);
        pos[0] = '\0';
 
        dbg(udev, "stat '%s'\n", p);