anitazha / rpms / systemd

Forked from rpms/systemd 3 years ago
Clone

Blame SOURCES/0694-core-enforce-a-limit-on-STATUS-texts-recvd-from-serv.patch

c62b8e
From b71d112385937fdffac8bb78df279b23bc9441c4 Mon Sep 17 00:00:00 2001
c62b8e
From: Jan Synacek <jsynacek@redhat.com>
c62b8e
Date: Tue, 4 Dec 2018 10:01:35 +0100
c62b8e
Subject: [PATCH] core: enforce a limit on STATUS= texts recvd from services
c62b8e
c62b8e
Let's better be safe than sorry, and put a limit on what we receive.
c62b8e
c62b8e
(cherry picked from commit 3eac1bcae9284fb8b18f4b82156c0e85ddb004e5)
c62b8e
c62b8e
Related: CVE-2018-15686
c62b8e
---
c62b8e
 src/core/service.c | 8 ++++++--
c62b8e
 src/core/service.h | 2 ++
c62b8e
 2 files changed, 8 insertions(+), 2 deletions(-)
c62b8e
c62b8e
diff --git a/src/core/service.c b/src/core/service.c
c62b8e
index 4d542ad947..fe6e2ff17c 100644
c62b8e
--- a/src/core/service.c
c62b8e
+++ b/src/core/service.c
c62b8e
@@ -3045,8 +3045,12 @@ static void service_notify_message(Unit *u, pid_t pid, char **tags, FDSet *fds)
c62b8e
                 _cleanup_free_ char *t = NULL;
c62b8e
 
c62b8e
                 if (!isempty(e)) {
c62b8e
-                        if (!utf8_is_valid(e))
c62b8e
-                                log_unit_warning(u->id, "Status message in notification is not UTF-8 clean.");
c62b8e
+                        /* Note that this size limit check is mostly paranoia: since the datagram size we are willing
c62b8e
+                         * to process is already limited to NOTIFY_BUFFER_MAX, this limit here should never be hit. */
c62b8e
+                        if (strlen(e) > STATUS_TEXT_MAX)
c62b8e
+                                log_unit_warning(u->id, "Status message overly long (%zu > %u), ignoring.", strlen(e), STATUS_TEXT_MAX);
c62b8e
+                        else if (!utf8_is_valid(e))
c62b8e
+                                log_unit_warning(u->id, "Status message in notification message is not UTF-8 clean, ignoring.");
c62b8e
                         else {
c62b8e
                                 log_unit_debug(u->id, "%s: got STATUS=%s", u->id, e);
c62b8e
 
c62b8e
diff --git a/src/core/service.h b/src/core/service.h
c62b8e
index 1f937dfe57..e0547a464e 100644
c62b8e
--- a/src/core/service.h
c62b8e
+++ b/src/core/service.h
c62b8e
@@ -31,6 +31,8 @@ typedef struct ServiceFDStore ServiceFDStore;
c62b8e
 #include "exit-status.h"
c62b8e
 #include "emergency-action.h"
c62b8e
 
c62b8e
+#define STATUS_TEXT_MAX (16U*1024U)
c62b8e
+
c62b8e
 typedef enum ServiceState {
c62b8e
         SERVICE_DEAD,
c62b8e
         SERVICE_START_PRE,