string-util: make sure we eat even half complete words in split()

split() and FOREACH_WORD really should die, and everything be moved to
extract_first_word() and friends, but let's at least make sure that for
the remaining code using it we can't deadlock by not progressing in the
word iteration.

Fixes: #15305

2 files changed, 8 insertions, 3 deletions

diff --git a/src/basic/string-util.c b/src/basic/string-util.c
index 2eb84babd8..9983aa826e 100644
--- a/src/basic/string-util.c
+++ b/src/basic/string-util.c
@@ -113,7 +113,7 @@ static size_t strcspn_escaped(const char *s, const char *reject) {
         bool escaped = false;
         int n;
 
-        for (n=0; s[n]; n++) {
+        for (n = 0; s[n] != '\0'; n++) {
                 if (escaped)
                         escaped = false;
                 else if (s[n] == '\\')
@@ -122,8 +122,7 @@ static size_t strcspn_escaped(const char *s, const char *reject) {
                         break;
         }
 
-        /* if s ends in \, return index of previous char */
-        return n - escaped;
+        return n;
 }
 
 /* Split a string into words. */
diff --git a/src/test/test-strv.c b/src/test/test-strv.c
index 68c128cf80..5473e983bd 100644
--- a/src/test/test-strv.c
+++ b/src/test/test-strv.c
@@ -307,6 +307,12 @@ static void test_strv_split(void) {
         l = strv_split_full("    'one'  \"  two\t three \"' four  five", NULL, SPLIT_QUOTES | SPLIT_RELAX);
         assert_se(l);
         assert_se(strv_equal(l, (char**) input_table_quoted));
+
+        strv_free_erase(l);
+
+        l = strv_split_full("\\", NULL, SPLIT_QUOTES | SPLIT_RELAX);
+        assert_se(l);
+        assert_se(strv_equal(l, STRV_MAKE("\\")));
 }
 
 static void test_strv_split_empty(void) {