|
 |
ddca0b |
From 9c23ceef0a08ffdf4aed7a96ec440e1b110568ac Mon Sep 17 00:00:00 2001
|
|
|
a3e2b5 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
a3e2b5 |
Date: Thu, 17 Jan 2019 18:14:17 +0100
|
|
|
a3e2b5 |
Subject: [PATCH] sd-bus: reorder bus ref and bus message ref handling
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
Let's always place handling of these references together, so that all
|
|
|
a3e2b5 |
reference counting during allocation is at a single place.
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
(cherry picked from commit e593b6a87a335267e5f7238b14683b7f840a01a3)
|
|
|
a3e2b5 |
Related: CVE-2020-1712
|
|
|
a3e2b5 |
---
|
|
|
a3e2b5 |
src/libsystemd/sd-bus/bus-message.c | 5 +++--
|
|
|
a3e2b5 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
|
|
|
ddca0b |
index 19cb2b9a97..e9cdf46c91 100644
|
|
|
a3e2b5 |
--- a/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
+++ b/src/libsystemd/sd-bus/bus-message.c
|
|
|
a3e2b5 |
@@ -461,7 +461,6 @@ int bus_message_from_header(
|
|
|
a3e2b5 |
if (!m)
|
|
|
a3e2b5 |
return -ENOMEM;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
- m->n_ref = 1;
|
|
|
a3e2b5 |
m->sealed = true;
|
|
|
a3e2b5 |
m->header = header;
|
|
|
a3e2b5 |
m->header_accessible = header_accessible;
|
|
|
a3e2b5 |
@@ -515,7 +514,9 @@ int bus_message_from_header(
|
|
|
a3e2b5 |
m->creds.mask |= SD_BUS_CREDS_SELINUX_CONTEXT;
|
|
|
a3e2b5 |
}
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
+ m->n_ref = 1;
|
|
|
a3e2b5 |
m->bus = sd_bus_ref(bus);
|
|
|
a3e2b5 |
+
|
|
|
a3e2b5 |
*ret = TAKE_PTR(m);
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
return 0;
|
|
|
a3e2b5 |
@@ -588,13 +589,13 @@ _public_ int sd_bus_message_new(
|
|
|
a3e2b5 |
return -ENOMEM;
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
t->n_ref = 1;
|
|
|
a3e2b5 |
+ t->bus = sd_bus_ref(bus);
|
|
|
a3e2b5 |
t->header = (struct bus_header*) ((uint8_t*) t + ALIGN(sizeof(struct sd_bus_message)));
|
|
|
a3e2b5 |
t->header->endian = BUS_NATIVE_ENDIAN;
|
|
|
a3e2b5 |
t->header->type = type;
|
|
|
a3e2b5 |
t->header->version = bus->message_version;
|
|
|
a3e2b5 |
t->allow_fds = bus->can_fds || !IN_SET(bus->state, BUS_HELLO, BUS_RUNNING);
|
|
|
a3e2b5 |
t->root_container.need_offsets = BUS_MESSAGE_IS_GVARIANT(t);
|
|
|
a3e2b5 |
- t->bus = sd_bus_ref(bus);
|
|
|
a3e2b5 |
|
|
|
a3e2b5 |
if (bus->allow_interactive_authorization)
|
|
|
a3e2b5 |
t->header->flags |= BUS_MESSAGE_ALLOW_INTERACTIVE_AUTHORIZATION;
|