udev: ensure tag parsing stays within bounds

This cannot actually happen, but add a safety check nonetheless.

Reported on yeswehack.com as:
YWH-PGM9780-43

Follow-up for d7867b31836173d1a943ecb1cab6484536126411

diff --git a/src/udev/udev-builtin-path_id.c b/src/udev/udev-builtin-path_id.c
index 4db20e4a13f9c3495eb4bc799df5806a7acdb168..cdd8da3203fea53e106e82d869cfa52b7cc29381 100644 (file)
--- a/src/udev/udev-builtin-path_id.c
+++ b/src/udev/udev-builtin-path_id.c
@@ -654,7 +654,7 @@ static void add_id_tag(UdevEvent *event, const char *path) {
         size_t i = 0;
 
         /* compose valid udev tag name */
-        for (const char *p = path; *p; p++) {
+        for (const char *p = path; *p && i < sizeof(tag) - 1; p++) {
                 if (ascii_isdigit(*p) ||
                     ascii_isalpha(*p) ||
                     *p == '-') {