libzfs: String trimming should not operate out of bounds

Forward slashes are trimmed from ZPOOL_IMPORT_PATH, but if someone sets
a ZPOOL_IMPORT_PATH that is only forward slashes, our trim code will
underflow the string, causing an out of bounds operation.

Similarly, the SMB code could potentially trim a string consisting of
only new line characters until it experiences the same bug. The same fix
is applied to it.

These are memory bugs, but I suspect that it is very unlikely that they
would cause a problem, since the probability that an out of bounds write
would follow the out of bounds read should be low. That said, going out
of bounds is undefined behavior, which could cause incorrect code
generation should a compiler look at it wrong, so let us fix this.

Reported-by: Grok 4.5 Build Beta

Signed-off-by: Richard Yao <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Alexander Motin <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Closes #18868

lib/libzfs/os/linux/libzfs_share_smb.c

@@ -130,8 +130,9 @@ smb_retrieve_shares(void)
 				continue;
 
 			/* Trim trailing new-line character(s). */
-			while (line[strlen(line) - 1] == '\r' ||
-			    line[strlen(line) - 1] == '\n')
+			while ((line[0] != '\0') &&
+			    (line[strlen(line) - 1] == '\r' ||
+			    line[strlen(line) - 1] == '\n'))
 				line[strlen(line) - 1] = '\0';
 
 			/* Split the line in two, separated by '=' */

lib/libzutil/zutil_device_path.c

@@ -134,7 +134,7 @@ zfs_strcmp_shortname(const char *name, const char *cmp_name, int wholedisk)
 	while (dir) {
 		/* Trim trailing directory slashes from ZPOOL_IMPORT_PATH */
 		if (env) {
-			while (dir[strlen(dir)-1] == '/')
+			while ((dir[0] != '\0') && (dir[strlen(dir)-1] == '/'))
 				dir[strlen(dir)-1] = '\0';
 		}