sd-bus: don't choke if somebody sends us a message with a unix fd count of 0

[elogind.git] / src / libsystemd / sd-bus / bus-message.c

diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index fe84f3f0bcc8284f802486a953681411b6de95e7..b9d7f6dbfd2961fd1e83548b74d1717581413c85 100644 (file)
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -509,10 +509,10 @@ static sd_bus_message *message_new(sd_bus *bus, uint8_t type) {
 
 _public_ int sd_bus_message_new_signal(
                 sd_bus *bus,
+                sd_bus_message **m,
                 const char *path,
                 const char *interface,
-                const char *member,
-                sd_bus_message **m) {
+                const char *member) {
 
         sd_bus_message *t;
         int r;
@@ -549,11 +549,11 @@ fail:
 
 _public_ int sd_bus_message_new_method_call(
                 sd_bus *bus,
+                sd_bus_message **m,
                 const char *destination,
                 const char *path,
                 const char *interface,
-                const char *member,
-                sd_bus_message **m) {
+                const char *member) {
 
         sd_bus_message *t;
         int r;
@@ -617,7 +617,7 @@ static int message_new_reply(
         t->header->flags |= BUS_MESSAGE_NO_REPLY_EXPECTED;
         t->reply_cookie = BUS_MESSAGE_COOKIE(call);
 
-        r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, t->reply_cookie);
+        r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) t->reply_cookie);
         if (r < 0)
                 goto fail;
 
@@ -647,8 +647,8 @@ _public_ int sd_bus_message_new_method_return(
 
 _public_ int sd_bus_message_new_method_error(
                 sd_bus_message *call,
-                const sd_bus_error *e,
-                sd_bus_message **m) {
+                sd_bus_message **m,
+                const sd_bus_error *e) {
 
         sd_bus_message *t;
         int r;
@@ -697,23 +697,23 @@ _public_ int sd_bus_message_new_method_errorf(
         bus_error_setfv(&error, name, format, ap);
         va_end(ap);
 
-        return sd_bus_message_new_method_error(call, &error, m);
+        return sd_bus_message_new_method_error(call, m, &error);
 }
 
 _public_ int sd_bus_message_new_method_errno(
                 sd_bus_message *call,
+                sd_bus_message **m,
                 int error,
-                const sd_bus_error *p,
-                sd_bus_message **m) {
+                const sd_bus_error *p) {
 
         _cleanup_free_ sd_bus_error berror = SD_BUS_ERROR_NULL;
 
         if (sd_bus_error_is_set(p))
-                return sd_bus_message_new_method_error(call, p, m);
+                return sd_bus_message_new_method_error(call, m, p);
 
         sd_bus_error_set_errno(&berror, error);
 
-        return sd_bus_message_new_method_error(call, &berror, m);
+        return sd_bus_message_new_method_error(call, m, &berror);
 }
 
 _public_ int sd_bus_message_new_method_errnof(
@@ -730,7 +730,7 @@ _public_ int sd_bus_message_new_method_errnof(
         bus_error_set_errnofv(&berror, error, format, ap);
         va_end(ap);
 
-        return sd_bus_message_new_method_error(call, &berror, m);
+        return sd_bus_message_new_method_error(call, m, &berror);
 }
 
 int bus_message_new_synthetic_error(
@@ -752,7 +752,7 @@ int bus_message_new_synthetic_error(
         t->header->flags |= BUS_MESSAGE_NO_REPLY_EXPECTED;
         t->reply_cookie = cookie;
 
-        r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, t->reply_cookie);
+        r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) t->reply_cookie);
         if (r < 0)
                 goto fail;
 
@@ -4885,6 +4885,7 @@ int bus_message_parse_fields(sd_bus_message *m) {
         size_t ri;
         int r;
         uint32_t unix_fds = 0;
+        bool unix_fds_set = false;
         void *offsets = NULL;
         unsigned n_offsets = 0;
         size_t sz = 0;
@@ -5075,24 +5076,29 @@ int bus_message_parse_fields(sd_bus_message *m) {
                         break;
                 }
 
-                case BUS_MESSAGE_HEADER_REPLY_SERIAL:
+                case BUS_MESSAGE_HEADER_REPLY_SERIAL: {
+                        uint32_t serial;
+
                         if (m->reply_cookie != 0)
                                 return -EBADMSG;
 
                         if (!streq(signature, "u"))
                                 return -EBADMSG;
 
-                        r = message_peek_field_uint32(m, &ri, item_size, &m->reply_cookie);
+                        r = message_peek_field_uint32(m, &ri, item_size, &serial);
                         if (r < 0)
                                 return r;
 
+                        m->reply_cookie = serial;
+
                         if (m->reply_cookie == 0)
                                 return -EBADMSG;
 
                         break;
+                }
 
                 case BUS_MESSAGE_HEADER_UNIX_FDS:
-                        if (unix_fds != 0)
+                        if (unix_fds_set)
                                 return -EBADMSG;
 
                         if (!streq(signature, "u"))
@@ -5102,9 +5108,7 @@ int bus_message_parse_fields(sd_bus_message *m) {
                         if (r < 0)
                                 return -EBADMSG;
 
-                        if (unix_fds == 0)
-                                return -EBADMSG;
-
+                        unix_fds_set = true;
                         break;
 
                 default:
@@ -5468,14 +5472,14 @@ int bus_message_remarshal(sd_bus *bus, sd_bus_message **m) {
         switch ((*m)->header->type) {
 
         case SD_BUS_MESSAGE_SIGNAL:
-                r = sd_bus_message_new_signal(bus, (*m)->path, (*m)->interface, (*m)->member, &n);
+                r = sd_bus_message_new_signal(bus, &n, (*m)->path, (*m)->interface, (*m)->member);
                 if (r < 0)
                         return r;
 
                 break;
 
         case SD_BUS_MESSAGE_METHOD_CALL:
-                r = sd_bus_message_new_method_call(bus, (*m)->destination, (*m)->path, (*m)->interface, (*m)->member, &n);
+                r = sd_bus_message_new_method_call(bus, &n, (*m)->destination, (*m)->path, (*m)->interface, (*m)->member);
                 if (r < 0)
                         return r;
 
@@ -5489,7 +5493,7 @@ int bus_message_remarshal(sd_bus *bus, sd_bus_message **m) {
                         return -ENOMEM;
 
                 n->reply_cookie = (*m)->reply_cookie;
-                r = message_append_field_uint32(n, BUS_MESSAGE_HEADER_REPLY_SERIAL, n->reply_cookie);
+                r = message_append_field_uint32(n, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) n->reply_cookie);
                 if (r < 0)
                         return r;