chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
bus: properly validate object path values
[elogind.git]
/
src
/
libsystemd-bus
/
bus-message.c
diff --git
a/src/libsystemd-bus/bus-message.c
b/src/libsystemd-bus/bus-message.c
index 524f17eb9f952707ebdbc91da3c98121a4c14e1c..f5b60f27280cca67e7a9ff30b012a9ee954f9a91 100644
(file)
--- a/
src/libsystemd-bus/bus-message.c
+++ b/
src/libsystemd-bus/bus-message.c
@@
-1374,8
+1374,7
@@
static int message_peek_body(sd_bus_message *m, size_t *rindex, size_t align, si
return buffer_peek(m->body, BUS_MESSAGE_BODY_SIZE(m), rindex, align, nbytes, ret);
}
return buffer_peek(m->body, BUS_MESSAGE_BODY_SIZE(m), rindex, align, nbytes, ret);
}
-static bool validate_string(const char *s, size_t l) {
- assert(s);
+static bool validate_nul(const char *s, size_t l) {
/* Check for NUL chars in the string */
if (memchr(s, 0, l))
/* Check for NUL chars in the string */
if (memchr(s, 0, l))
@@
-1385,6
+1384,14
@@
static bool validate_string(const char *s, size_t l) {
if (s[l] != 0)
return false;
if (s[l] != 0)
return false;
+ return true;
+}
+
+static bool validate_string(const char *s, size_t l) {
+
+ if (!validate_nul(s, l))
+ return false;
+
/* Check if valid UTF8 */
if (!utf8_is_valid(s))
return false;
/* Check if valid UTF8 */
if (!utf8_is_valid(s))
return false;
@@
-1393,12
+1400,8
@@
static bool validate_string(const char *s, size_t l) {
}
static bool validate_signature(const char *s, size_t l) {
}
static bool validate_signature(const char *s, size_t l) {
- /* Check for NUL chars in the signature */
- if (memchr(s, 0, l))
- return false;
- /* Check for NUL termination */
- if (s[l] != 0)
+ if (!validate_nul(s, l))
return false;
/* Check if valid signature */
return false;
/* Check if valid signature */
@@
-1408,6
+1411,17
@@
static bool validate_signature(const char *s, size_t l) {
return true;
}
return true;
}
+static bool validate_object_path(const char *s, size_t l) {
+
+ if (!validate_nul(s, l))
+ return false;
+
+ if (!object_path_is_valid(s))
+ return false;
+
+ return true;
+}
+
int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
struct bus_container *c;
int r;
int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
struct bus_container *c;
int r;
@@
-1447,8
+1461,13
@@
int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
if (r == 0)
return -EBADMSG;
if (r == 0)
return -EBADMSG;
- if (!validate_string(q, l))
- return -EBADMSG;
+ if (type == SD_BUS_TYPE_OBJECT_PATH) {
+ if (!validate_object_path(q, l))
+ return -EBADMSG;
+ } else {
+ if (!validate_string(q, l))
+ return -EBADMSG;
+ }
m->rindex = rindex;
*(const char**) p = q;
m->rindex = rindex;
*(const char**) p = q;
@@
-1565,7
+1584,7
@@
static int bus_message_enter_array(
if (r <= 0)
return r;
if (r <= 0)
return r;
- if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) >
67108864
)
+ if (BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q) >
BUS_ARRAY_MAX_SIZE
)
return -EBADMSG;
r = message_peek_body(m, &rindex, alignment, 0, NULL);
return -EBADMSG;
r = message_peek_body(m, &rindex, alignment, 0, NULL);
@@
-2104,6
+2123,7
@@
static int message_peek_fields(
static int message_peek_field_string(
sd_bus_message *m,
static int message_peek_field_string(
sd_bus_message *m,
+ char type,
size_t *ri,
const char **ret) {
size_t *ri,
const char **ret) {
@@
-2123,8
+2143,13
@@
static int message_peek_field_string(
if (r < 0)
return r;
if (r < 0)
return r;
- if (!validate_string(q, l))
- return -EBADMSG;
+ if (type == SD_BUS_TYPE_OBJECT_PATH) {
+ if (!validate_object_path(q, l))
+ return -EBADMSG;
+ } else {
+ if (!validate_string(q, l))
+ return -EBADMSG;
+ }
if (ret)
*ret = q;
if (ret)
*ret = q;
@@
-2214,7
+2239,7
@@
static int message_skip_fields(
if (t == SD_BUS_TYPE_STRING ||
t == SD_BUS_TYPE_OBJECT_PATH) {
if (t == SD_BUS_TYPE_STRING ||
t == SD_BUS_TYPE_OBJECT_PATH) {
- r = message_peek_field_string(m, ri, NULL);
+ r = message_peek_field_string(m,
t,
ri, NULL);
if (r < 0)
return r;
if (r < 0)
return r;
@@
-2264,7
+2289,7
@@
static int message_skip_fields(
return r;
nas = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
return r;
nas = BUS_MESSAGE_BSWAP32(m, *(uint32_t*) q);
- if (nas >
67108864
)
+ if (nas >
BUS_ARRAY_MAX_SIZE
)
return -EBADMSG;
r = message_peek_fields(m, ri, alignment, 0, NULL);
return -EBADMSG;
r = message_peek_fields(m, ri, alignment, 0, NULL);
@@
-2341,42
+2366,42
@@
static int message_parse_fields(sd_bus_message *m) {
if (!streq(signature, "o"))
return -EBADMSG;
if (!streq(signature, "o"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->path);
+ r = message_peek_field_string(m,
'o',
&ri, &m->path);
break;
case SD_BUS_MESSAGE_HEADER_INTERFACE:
if (!streq(signature, "s"))
return -EBADMSG;
break;
case SD_BUS_MESSAGE_HEADER_INTERFACE:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->interface);
+ r = message_peek_field_string(m,
's',
&ri, &m->interface);
break;
case SD_BUS_MESSAGE_HEADER_MEMBER:
if (!streq(signature, "s"))
return -EBADMSG;
break;
case SD_BUS_MESSAGE_HEADER_MEMBER:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->member);
+ r = message_peek_field_string(m,
's',
&ri, &m->member);
break;
case SD_BUS_MESSAGE_HEADER_ERROR_NAME:
if (!streq(signature, "s"))
return -EBADMSG;
break;
case SD_BUS_MESSAGE_HEADER_ERROR_NAME:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->error.name);
+ r = message_peek_field_string(m,
's',
&ri, &m->error.name);
break;
case SD_BUS_MESSAGE_HEADER_DESTINATION:
if (!streq(signature, "s"))
return -EBADMSG;
break;
case SD_BUS_MESSAGE_HEADER_DESTINATION:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->destination);
+ r = message_peek_field_string(m,
's',
&ri, &m->destination);
break;
case SD_BUS_MESSAGE_HEADER_SENDER:
if (!streq(signature, "s"))
return -EBADMSG;
break;
case SD_BUS_MESSAGE_HEADER_SENDER:
if (!streq(signature, "s"))
return -EBADMSG;
- r = message_peek_field_string(m, &ri, &m->sender);
+ r = message_peek_field_string(m,
's',
&ri, &m->sender);
break;
break;