From eee2817deceed6c5abe3109700aef2c63d6d519c Mon Sep 17 00:00:00 2001
From: Doug Rabson <dfr@rabson.org>
Date: Mon, 24 Jul 2023 16:52:54 +0100
Subject: [PATCH] pkg/specgen: Don't crash for device spec with...

...empty destination path

This fixes a server-side crash for command lines like:

  # podman run -ti --rm --device /dev/mem::rw alpine sh

Fixes #19335.

Signed-off-by: Doug Rabson <dfr@rabson.org>
---
 pkg/specgen/generate/config_linux.go      |  2 +-
 pkg/specgen/generate/config_linux_test.go | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/pkg/specgen/generate/config_linux.go b/pkg/specgen/generate/config_linux.go
index 965072a0a8..6f5484db6e 100644
--- a/pkg/specgen/generate/config_linux.go
+++ b/pkg/specgen/generate/config_linux.go
@@ -193,7 +193,7 @@ func ParseDevice(device string) (string, string, string, error) {
 		if IsValidDeviceMode(arr[1]) {
 			permissions = arr[1]
 		} else {
-			if arr[1][0] != '/' {
+			if len(arr[1]) > 0 && arr[1][0] != '/' {
 				return "", "", "", fmt.Errorf("invalid device mode: %s", arr[1])
 			}
 			dst = arr[1]
diff --git a/pkg/specgen/generate/config_linux_test.go b/pkg/specgen/generate/config_linux_test.go
index 39973324b3..47703cdb20 100644
--- a/pkg/specgen/generate/config_linux_test.go
+++ b/pkg/specgen/generate/config_linux_test.go
@@ -26,3 +26,25 @@ func TestShouldMask(t *testing.T) {
 		assert.Equal(t, val, test.shouldMask)
 	}
 }
+
+func TestParseDevice(t *testing.T) {
+	tests := []struct {
+		device string
+		src    string
+		dst    string
+		perm   string
+	}{
+		{"/dev/foo", "/dev/foo", "/dev/foo", "rwm"},
+		{"/dev/foo:/dev/bar", "/dev/foo", "/dev/bar", "rwm"},
+		{"/dev/foo:/dev/bar:rw", "/dev/foo", "/dev/bar", "rw"},
+		{"/dev/foo:rw", "/dev/foo", "/dev/foo", "rw"},
+		{"/dev/foo::rw", "/dev/foo", "/dev/foo", "rw"},
+	}
+	for _, test := range tests {
+		src, dst, perm, err := ParseDevice(test.device)
+		assert.NoError(t, err)
+		assert.Equal(t, src, test.src)
+		assert.Equal(t, dst, test.dst)
+		assert.Equal(t, perm, test.perm)
+	}
+}