|
 |
a3e2b5 |
From 87922b7adc47f311e89b21e37b26ee300a401e1d Mon Sep 17 00:00:00 2001
|
|
|
a3e2b5 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
a3e2b5 |
Date: Mon, 9 Jul 2018 13:21:44 +0200
|
|
|
a3e2b5 |
Subject: [PATCH] bus-message: do not crash on message with a string of zero
|
|
|
a3e2b5 |
length
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
We'd calculate the "real" length of the string as 'item_size - 1', which does
|
|
|
a3e2b5 |
not work out well when item_size == 0.
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
(cherry picked from commit 81b6e63029eefcb0ec03a3a7c248490e38106073)
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
Resolves: #1635439
|
|
|
a3e2b5 |
---
|
|
|
a3e2b5 |
src/libsystemd/sd-bus/bus-message.c | 6 ++++++
|
|
|
a3e2b5 |
.../crash-29ed3c202e0ffade3cad42c8bbeb6cc68a21eb8e | Bin 0 -> 51 bytes
|
|
|
a3e2b5 |
2 files changed, 6 insertions(+)
|
|
|
a3e2b5 |
create mode 100644 test/fuzz/fuzz-bus-message/crash-29ed3c202e0ffade3cad42c8bbeb6cc68a21eb8e
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
index 8d92bc2002..381034f5f8 100644
|
|
|
a3e2b5 |
--- a/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
+++ b/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
@@ -3312,6 +3312,12 @@ _public_ int sd_bus_message_read_basic(sd_bus_message *m, char type, void *p) {
|
|
|
a3e2b5 |
if (IN_SET(type, SD_BUS_TYPE_STRING, SD_BUS_TYPE_OBJECT_PATH, SD_BUS_TYPE_SIGNATURE)) {
|
|
|
a3e2b5 |
bool ok;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
+ /* D-Bus spec: The marshalling formats for the string-like types all end
|
|
|
a3e2b5 |
+ * with a single zero (NUL) byte, but that byte is not considered to be part
|
|
|
a3e2b5 |
+ * of the text. */
|
|
|
a3e2b5 |
+ if (c->item_size == 0)
|
|
|
a3e2b5 |
+ return -EBADMSG;
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
r = message_peek_body(m, &rindex, 1, c->item_size, &q);
|
|
|
a3e2b5 |
if (r < 0)
|
|
|
a3e2b5 |
return r;
|
|
|
a3e2b5 |
diff --git a/test/fuzz/fuzz-bus-message/crash-29ed3c202e0ffade3cad42c8bbeb6cc68a21eb8e b/test/fuzz/fuzz-bus-message/crash-29ed3c202e0ffade3cad42c8bbeb6cc68a21eb8e
|
|
|
a3e2b5 |
new file mode 100644
|
|
|
a3e2b5 |
index 0000000000000000000000000000000000000000..4488f0a6c685b5d43eddbe41a0c6a3b6be9b02e2
|
|
|
a3e2b5 |
GIT binary patch
|
|
|
a3e2b5 |
literal 51
|
|
|
a3e2b5 |
fcmc~1WMC4sJpJnr13KV`0|t%6q+%$@&=ddw)CUPg
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
literal 0
|
|
|
a3e2b5 |
HcmV?d00001
|
|
|
a3e2b5 |
|