chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
sd-daemon: fix potential LISTEN_FDS overflow in sd_listen_fds()
[elogind.git]
/
src
/
libelogind
/
sd-daemon
/
sd-daemon.c
diff --git
a/src/libelogind/sd-daemon/sd-daemon.c
b/src/libelogind/sd-daemon/sd-daemon.c
index e10444f498eae0efa71bb8a37e9642b704cc0b64..3ea9764c45bd383ec24d9272ed9e3b8b61b5db4f 100644
(file)
--- a/
src/libelogind/sd-daemon/sd-daemon.c
+++ b/
src/libelogind/sd-daemon/sd-daemon.c
@@
-54,8
+54,7
@@
static void unsetenv_all(bool unset_environment) {
_public_ int sd_listen_fds(int unset_environment) {
const char *e;
_public_ int sd_listen_fds(int unset_environment) {
const char *e;
- unsigned n;
- int r, fd;
+ int n, r, fd;
pid_t pid;
e = getenv("LISTEN_PID");
pid_t pid;
e = getenv("LISTEN_PID");
@@
-80,17
+79,23
@@
_public_ int sd_listen_fds(int unset_environment) {
goto finish;
}
goto finish;
}
- r = safe_ato
u
(e, &n);
+ r = safe_ato
i
(e, &n);
if (r < 0)
goto finish;
if (r < 0)
goto finish;
- for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + (int) n; fd ++) {
+ assert_cc(SD_LISTEN_FDS_START < INT_MAX);
+ if (n <= 0 || n > INT_MAX - SD_LISTEN_FDS_START) {
+ r = -EINVAL;
+ goto finish;
+ }
+
+ for (fd = SD_LISTEN_FDS_START; fd < SD_LISTEN_FDS_START + n; fd ++) {
r = fd_cloexec(fd, true);
if (r < 0)
goto finish;
}
r = fd_cloexec(fd, true);
if (r < 0)
goto finish;
}
- r =
(int)
n;
+ r = n;
finish:
unsetenv_all(unset_environment);
finish:
unsetenv_all(unset_environment);
@@
-436,6
+441,11
@@
_public_ int sd_pid_notify_with_fds(pid_t pid, int unset_environment, const char
goto finish;
}
goto finish;
}
+ if (strlen(e) > sizeof(sockaddr.un.sun_path)) {
+ r = -EINVAL;
+ goto finish;
+ }
+
fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
if (fd < 0) {
r = -errno;
fd = socket(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0);
if (fd < 0) {
r = -errno;