case SD_BUS_TYPE_STRING:
case SD_BUS_TYPE_OBJECT_PATH:
+
+ if (!p) {
+ if (e)
+ c->signature[c->index] = 0;
+
+ return -EINVAL;
+ }
+
align = 4;
sz = 4 + strlen(p) + 1;
break;
case SD_BUS_TYPE_SIGNATURE:
+
+ if (!p) {
+ if (e)
+ c->signature[c->index] = 0;
+
+ return -EINVAL;
+ }
+
align = 1;
sz = 1 + strlen(p) + 1;
break;
return buffer_peek(m->body, BUS_MESSAGE_BODY_SIZE(m), rindex, align, nbytes, ret);
}
-static bool validate_string(const char *s, size_t l) {
- assert(s);
+static bool validate_nul(const char *s, size_t l) {
/* Check for NUL chars in the string */
if (memchr(s, 0, l))
if (s[l] != 0)
return false;
+ return true;
+}
+
+static bool validate_string(const char *s, size_t l) {
+
+ if (!validate_nul(s, l))
+ return false;
+
/* Check if valid UTF8 */
if (!utf8_is_valid(s))
return false;
}
static bool validate_signature(const char *s, size_t l) {
- /* Check for NUL chars in the signature */
- if (memchr(s, 0, l))
- return false;
- /* Check for NUL termination */
- if (s[l] != 0)
+ if (!validate_nul(s, l))
return false;
/* Check if valid signature */
return true;
}
+static bool validate_object_path(const char *s, size_t l) {
+
+ if (!validate_nul(s, l))
+ return false;
+
+ if (!object_path_is_valid(s))
+ return false;
+
+ return true;
+}
+
int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
struct bus_container *c;
int r;
if (r == 0)
return -EBADMSG;
- if (!validate_string(q, l))
- return -EBADMSG;
+ if (type == SD_BUS_TYPE_OBJECT_PATH) {
+ if (!validate_object_path(q, l))
+ return -EBADMSG;
+ } else {
+ if (!validate_string(q, l))
+ return -EBADMSG;
+ }
m->rindex = rindex;
*(const char**) p = q;
if (r <= 0)
return r;
- if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) > 67108864)
+ if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) > BUS_ARRAY_MAX_SIZE)
return -EBADMSG;
r = message_peek_body(m, &rindex, alignment, 0, NULL);
if (!contents)
return -EINVAL;
+ /*
+ * We enforce a global limit on container depth, that is much
+ * higher than the 32 structs and 32 arrays the specification
+ * mandates. This is simpler to implement for us, and we need
+ * this only to ensure our container array doesn't grow
+ * without bounds. We are happy to return any data from a
+ * message as long as the data itself is valid, even if the
+ * overall message might be not.
+ *
+ * Note that the message signature is validated when
+ * parsing the headers, and that validation does check the
+ * 32/32 limit.
+ *
+ * Note that the specification defines no limits on the depth
+ * of stacked variants, but we do.
+ */
+ if (m->n_containers >= BUS_CONTAINER_DEPTH)
+ return -EBADMSG;
+
w = realloc(m->containers, sizeof(struct bus_container) * (m->n_containers + 1));
if (!w)
return -ENOMEM;
return buffer_peek(m->fields, BUS_MESSAGE_FIELDS_SIZE(m), rindex, align, nbytes, ret);
}
-static int message_peek_field_string(
+static int message_peek_field_uint32(
sd_bus_message *m,
size_t *ri,
- const char **ret) {
+ uint32_t *ret) {
- size_t l;
int r;
void *q;
if (r < 0)
return r;
- l = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
- r = message_peek_fields(m, ri, 1, l+1, &q);
- if (r < 0)
- return r;
-
- if (!validate_string(q, l))
- return -EBADMSG;
-
if (ret)
- *ret = q;
+ *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
return 0;
}
-static int message_peek_field_signature(
+static int message_peek_field_string(
sd_bus_message *m,
+ bool (*validate)(const char *p),
size_t *ri,
const char **ret) {
- size_t l;
+ uint32_t l;
int r;
void *q;
assert(m);
assert(ri);
- r = message_peek_fields(m, ri, 1, 1, &q);
+ r = message_peek_field_uint32(m, ri, &l);
if (r < 0)
return r;
- l = *(uint8_t*) q;
r = message_peek_fields(m, ri, 1, l+1, &q);
if (r < 0)
return r;
- if (!validate_signature(q, l))
- return -EBADMSG;
+ if (validate) {
+ if (!validate_nul(q, l))
+ return -EBADMSG;
+
+ if (!validate(q))
+ return -EBADMSG;
+ } else {
+ if (!validate_string(q, l))
+ return -EBADMSG;
+ }
if (ret)
*ret = q;
return 0;
}
-static int message_peek_field_uint32(
+static int message_peek_field_signature(
sd_bus_message *m,
size_t *ri,
- uint32_t *ret) {
+ const char **ret) {
+ size_t l;
int r;
void *q;
assert(m);
assert(ri);
- r = message_peek_fields(m, ri, 4, 4, &q);
+ r = message_peek_fields(m, ri, 1, 1, &q);
if (r < 0)
return r;
+ l = *(uint8_t*) q;
+ r = message_peek_fields(m, ri, 1, l+1, &q);
+ if (r < 0)
+ return r;
+
+ if (!validate_signature(q, l))
+ return -EBADMSG;
+
if (ret)
- *ret = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
+ *ret = q;
return 0;
}
for (;;) {
char t;
- void *q;
size_t l;
if (array_size != (uint32_t) -1 &&
if (!t)
return 0;
- if (t == SD_BUS_TYPE_STRING ||
- t == SD_BUS_TYPE_OBJECT_PATH) {
+ if (t == SD_BUS_TYPE_STRING) {
- r = message_peek_field_string(m, ri, NULL);
+ r = message_peek_field_string(m, NULL, ri, NULL);
+ if (r < 0)
+ return r;
+
+ (*signature)++;
+
+ } else if (t == SD_BUS_TYPE_OBJECT_PATH) {
+
+ r = message_peek_field_string(m, object_path_is_valid, ri, NULL);
if (r < 0)
return r;
assert(l >= 1);
{
char sig[l-1], *s;
- size_t nas;
+ uint32_t nas;
int alignment;
strncpy(sig, *signature + 1, l-1);
if (alignment < 0)
return alignment;
- r = message_peek_fields(m, ri, 4, 4, &q);
+ r = message_peek_field_uint32(m, ri, &nas);
if (r < 0)
return r;
-
- nas = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
- if (nas > 67108864)
+ if (nas > BUS_ARRAY_MAX_SIZE)
return -EBADMSG;
r = message_peek_fields(m, ri, alignment, 0, NULL);
if (!streq(signature, "o"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->path);
+ r = message_peek_field_string(m, object_path_is_valid, &ri, &m->path);
break;
case SD_BUS_MESSAGE_HEADER_INTERFACE:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->interface);
+ r = message_peek_field_string(m, interface_name_is_valid, &ri, &m->interface);
break;
case SD_BUS_MESSAGE_HEADER_MEMBER:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->member);
+ r = message_peek_field_string(m, member_name_is_valid, &ri, &m->member);
break;
case SD_BUS_MESSAGE_HEADER_ERROR_NAME:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->error.name);
+ r = message_peek_field_string(m, error_name_is_valid, &ri, &m->error.name);
break;
case SD_BUS_MESSAGE_HEADER_DESTINATION:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->destination);
+ r = message_peek_field_string(m, service_name_is_valid, &ri, &m->destination);
break;
case SD_BUS_MESSAGE_HEADER_SENDER:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->sender);
+ r = message_peek_field_string(m, service_name_is_valid, &ri, &m->sender);
break;
free(m->root_container.signature);
m->root_container.signature = c;
-
- r = 0;
break;
}
return -EBADMSG;
r = message_peek_field_uint32(m, &ri, &m->reply_serial);
+ if (r < 0)
+ return r;
+
+ if (m->reply_serial == 0)
+ return -EBADMSG;
+
break;
default:
~ianmdlvl / elogind.git / blobdiff