bus: when parsing enforce maximum container depth

[elogind.git] / src / libsystemd-bus / bus-message.c

diff --git a/src/libsystemd-bus/bus-message.c b/src/libsystemd-bus/bus-message.c
index a22962559de8ed94c298443981c938e70da536ed..74ea71ec0d62bb6749898a384c0d993ed785c63f 100644 (file)
--- a/src/libsystemd-bus/bus-message.c
+++ b/src/libsystemd-bus/bus-message.c
@@ -1741,6 +1741,25 @@ int sd_bus_message_enter_container(sd_bus_message *m, char type, const char *con
         if (!contents)
                 return -EINVAL;
 
+        /*
+         * We enforce a global limit on container depth, that is much
+         * higher than the 32 structs and 32 arrays the specification
+         * mandates. This is simpler to implement for us, and we need
+         * this only to ensure our container array doesn't grow
+         * without bounds. We are happy to return any data from a
+         * message as long as the data itself is valid, even if the
+         * overall message might be not.
+         *
+         * Note that the message signature is validated when
+         * parsing the headers, and that validation does check the
+         * 32/32 limit.
+         *
+         * Note that the specification defines no limits on the depth
+         * of stacked variants, but we do.
+         */
+        if (m->n_containers >= BUS_CONTAINER_DEPTH)
+                return -EBADMSG;
+
         w = realloc(m->containers, sizeof(struct bus_container) * (m->n_containers + 1));
         if (!w)
                 return -ENOMEM;
@@ -2121,24 +2140,44 @@ static int message_peek_fields(
         return buffer_peek(m->fields, BUS_MESSAGE_FIELDS_SIZE(m), rindex, align, nbytes, ret);
 }
 
+static int message_peek_field_uint32(
+                sd_bus_message *m,
+                size_t *ri,
+                uint32_t *ret) {
+
+        int r;
+        void *q;
+
+        assert(m);
+        assert(ri);
+
+        r = message_peek_fields(m, ri, 4, 4, &q);
+        if (r < 0)
+                return r;
+
+        if (ret)
+                *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
+
+        return 0;
+}
+
 static int message_peek_field_string(
                 sd_bus_message *m,
                 bool (*validate)(const char *p),
                 size_t *ri,
                 const char **ret) {
 
-        size_t l;
+        uint32_t l;
         int r;
         void *q;
 
         assert(m);
         assert(ri);
 
-        r = message_peek_fields(m, ri, 4, 4, &q);
+        r = message_peek_field_uint32(m, ri, &l);
         if (r < 0)
                 return r;
 
-        l = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
         r = message_peek_fields(m, ri, 1, l+1, &q);
         if (r < 0)
                 return r;
@@ -2190,27 +2229,6 @@ static int message_peek_field_signature(
         return 0;
 }
 
-static int message_peek_field_uint32(
-                sd_bus_message *m,
-                size_t *ri,
-                uint32_t *ret) {
-
-        int r;
-        void *q;
-
-        assert(m);
-        assert(ri);
-
-        r = message_peek_fields(m, ri, 4, 4, &q);
-        if (r < 0)
-                return r;
-
-        if (ret)
-                *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
-
-        return 0;
-}
-
 static int message_skip_fields(
                 sd_bus_message *m,
                 size_t *ri,
@@ -2228,7 +2246,6 @@ static int message_skip_fields(
 
         for (;;) {
                 char t;
-                void *q;
                 size_t l;
 
                 if (array_size != (uint32_t) -1 &&
@@ -2284,7 +2301,7 @@ static int message_skip_fields(
                         assert(l >= 1);
                         {
                                 char sig[l-1], *s;
-                                size_t nas;
+                                uint32_t nas;
                                 int alignment;
 
                                 strncpy(sig, *signature + 1, l-1);
@@ -2294,11 +2311,9 @@ static int message_skip_fields(
                                 if (alignment < 0)
                                         return alignment;
 
-                                r = message_peek_fields(m, ri, 4, 4, &q);
+                                r = message_peek_field_uint32(m, ri, &nas);
                                 if (r < 0)
                                         return r;
-
-                                nas = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
                                 if (nas > BUS_ARRAY_MAX_SIZE)
                                         return -EBADMSG;
 
@@ -2432,8 +2447,6 @@ static int message_parse_fields(sd_bus_message *m) {
 
                         free(m->root_container.signature);
                         m->root_container.signature = c;
-
-                        r = 0;
                         break;
                 }