[PATCH] fix out of bounds array access in util_create_path()

[PATCH] fix out of bounds array access in util_create_path()

[Florian Zumbiehl]

Hi,

while reading some more udev source, I noticed a potential out of bounds
array access in util_create_path(), untested fix below.

Florian

diff --git a/libudev/libudev-util-private.c b/libudev/libudev-util-private.c
index 28008c5..15fac7c 100644
--- a/libudev/libudev-util-private.c
+++ b/libudev/libudev-util-private.c
@@ -34,11 +34,13 @@ int util_create_path(struct udev *udev, const char *path)
 
 	util_strscpy(p, sizeof(p), path);
 	pos = strrchr(p, '/');
-	if (pos = p || pos = NULL)
+	if (pos = NULL)
 		return 0;
-
-	while (pos[-1] = '/')
+	while (pos != p && pos[-1] = '/')
 		pos--;
+	if (pos = p)
+		return 0;
+
 	pos[0] = '\0';
 
 	dbg(udev, "stat '%s'\n", p);

Re: [PATCH] fix out of bounds array access in util_create_path()

[Kay Sievers]

On Fri, Aug 28, 2009 at 19:24, Florian Zumbiehl<florz@florz.de> wrote:
> while reading some more udev source, I noticed a potential out of bounds
> array access in util_create_path(), untested fix below.

Applied.

Thanks,
Kay