Found with afl, if path ends in '/', num_components will run off the end
of the string.

OK?

(this is on top of tb's fix on bugs but should be independent and not
cause conflicts.)

diff --git pch.c pch.c
index 63543a609fb..8c58dc9ffe5 100644
--- pch.c
+++ pch.c
@@ -1484,7 +1484,8 @@ num_components(const char *path)
        size_t n;
        const char *cp;
 
-       for (n = 0, cp = path; (cp = strchr(cp, '/')) != NULL; n++, cp++) {
+       for (n = 0, cp = path; (cp = strchr(cp, '/')) != NULL; n++) {
+               cp++;
                while (*cp == '/')
                        cp++;           /* skip consecutive slashes */
        }

-- 
In my defence, I have been left unsupervised.

Reply via email to