Make sure that the prefix is the name of a directory (not only the

beginning of a directory).
Openwall patch shadow-4.0.4.1-owl-userdel-path_prefix.diff.

src/userdel.c

@@ -542,7 +542,8 @@ static void user_cancel (const char *user)
 #ifdef EXTRA_CHECK_HOME_DIR
 static int path_prefix (const char *s1, const char *s2)
 {
-	return (strncmp (s2, s1, strlen (s1)) == 0);
+	return (strncmp (s2, s1, strlen (s1)) == 0 &&
+		(s2[strlen (s1)] == '\0' || s2[strlen (s1)] == '/'));
 }
 #endif