picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge pull request #11754 from poettering/bus-path-limit

Browse source 
sd-bus path limit fixes
This commit is contained in:
Yu Watanabe 2019-02-19 19:32:03 +09:00 committed by GitHub
parent 149b0ab25d f519a19bcd
commit 798ebaf9ae
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 59 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/libsystemd/sd-bus/bus-internal.c
View file

@ -43,7 +43,7 @@ bool object_path_is_valid(const char *p) {
if (slash)
return false;
return true;
return (q - p) <= BUS_PATH_SIZE_MAX;
}
char* object_path_startswith(const char *a, const char *b) {

4
src/libsystemd/sd-bus/bus-internal.h
View file

@ -332,6 +332,10 @@ struct sd_bus {
#define BUS_MESSAGE_SIZE_MAX (128*1024*1024)
#define BUS_AUTH_SIZE_MAX (64*1024)
/* Note that the D-Bus specification states that bus paths shall have no size limit. We enforce here one
* anyway, since truly unbounded strings are a security problem. The limit we pick is relatively large however,
* to not clash unnecessarily with real-life applications. */
#define BUS_PATH_SIZE_MAX (64*1024)
#define BUS_CONTAINER_DEPTH 128

68
src/libsystemd/sd-bus/bus-objects.c
View file

@ -1133,7 +1133,8 @@ static int object_manager_serialize_path_and_fallbacks(
const char *path,
sd_bus_error *error) {
char *prefix;
_cleanup_free_ char *prefix = NULL;
size_t pl;
int r;
assert(bus);
@ -1149,7 +1150,12 @@ static int object_manager_serialize_path_and_fallbacks(
return 0;
/* Second, add fallback vtables registered for any of the prefixes */
prefix = newa(char, strlen(path) + 1);
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
r = object_manager_serialize_path(bus, reply, prefix, path, true, error);
if (r < 0)
@ -1345,6 +1351,7 @@ static int object_find_and_run(
}
int bus_process_object(sd_bus *bus, sd_bus_message *m) {
_cleanup_free_ char *prefix = NULL;
int r;
size_t pl;
bool found_object = false;
@ -1369,9 +1376,12 @@ int bus_process_object(sd_bus *bus, sd_bus_message *m) {
assert(m->member);
pl = strlen(m->path);
do {
char prefix[pl+1];
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
do {
bus->nodes_modified = false;
r = object_find_and_run(bus, m, m->path, false, &found_object);
@ -1498,9 +1508,15 @@ static int bus_find_parent_object_manager(sd_bus *bus, struct node **out, const
n = hashmap_get(bus->nodes, path);
if (!n) {
char *prefix;
_cleanup_free_ char *prefix = NULL;
size_t pl;
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
prefix = newa(char, strlen(path) + 1);
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
n = hashmap_get(bus->nodes, prefix);
if (n)
@ -2083,8 +2099,9 @@ _public_ int sd_bus_emit_properties_changed_strv(
const char *interface,
char **names) {
_cleanup_free_ char *prefix = NULL;
bool found_interface = false;
char *prefix;
size_t pl;
int r;
assert_return(bus, -EINVAL);
@ -2105,6 +2122,12 @@ _public_ int sd_bus_emit_properties_changed_strv(
BUS_DONT_DESTROY(bus);
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
do {
bus->nodes_modified = false;
@ -2114,7 +2137,6 @@ _public_ int sd_bus_emit_properties_changed_strv(
if (bus->nodes_modified)
continue;
prefix = newa(char, strlen(path) + 1);
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
r = emit_properties_changed_on_interface(bus, prefix, path, interface, true, &found_interface, names);
if (r != 0)
@ -2246,7 +2268,8 @@ static int object_added_append_all_prefix(
static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *path) {
_cleanup_set_free_ Set *s = NULL;
char *prefix;
_cleanup_free_ char *prefix = NULL;
size_t pl;
int r;
assert(bus);
@ -2291,7 +2314,12 @@ static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *p
if (bus->nodes_modified)
return 0;
prefix = newa(char, strlen(path) + 1);
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
r = object_added_append_all_prefix(bus, m, s, prefix, path, true);
if (r < 0)
@ -2430,7 +2458,8 @@ static int object_removed_append_all_prefix(
static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char *path) {
_cleanup_set_free_ Set *s = NULL;
char *prefix;
_cleanup_free_ char *prefix = NULL;
size_t pl;
int r;
assert(bus);
@ -2462,7 +2491,12 @@ static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char
if (bus->nodes_modified)
return 0;
prefix = newa(char, strlen(path) + 1);
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
r = object_removed_append_all_prefix(bus, m, s, prefix, path, true);
if (r < 0)
@ -2612,7 +2646,8 @@ static int interfaces_added_append_one(
const char *path,
const char *interface) {
char *prefix;
_cleanup_free_ char *prefix = NULL;
size_t pl;
int r;
assert(bus);
@ -2626,7 +2661,12 @@ static int interfaces_added_append_one(
if (bus->nodes_modified)
return 0;
prefix = newa(char, strlen(path) + 1);
pl = strlen(path);
assert(pl <= BUS_PATH_SIZE_MAX);
prefix = new(char, pl + 1);
if (!prefix)
return -ENOMEM;
OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
r = interfaces_added_append_one_prefix(bus, m, prefix, path, interface, true);
if (r != 0)