Verify validity of session name when received from outside

[elogind.git] / src / login / logind.c

diff --git a/src/login/logind.c b/src/login/logind.c
index 9094567b8d91cd7f87d21ac80da9b5a09b522bd7..4ef92b825361c6dd1d14a9d98d068d76e3e49d63 100644 (file)
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -684,6 +684,12 @@ int manager_enumerate_sessions(Manager *m) {
                 if (!dirent_is_file(de))
                         continue;
 
+                if (!session_id_valid(de->d_name)) {
+                        log_warning("Invalid session file name '%s', ignoring.", de->d_name);
+                        r = -EINVAL;
+                        continue;
+                }
+
                 k = manager_add_session(m, de->d_name, &s);
                 if (k < 0) {
                         log_error("Failed to add session by file name %s: %s", de->d_name, strerror(-k));