anitazha / rpms / systemd

Forked from rpms/systemd 3 years ago
Clone

Blame SOURCES/0734-sd-bus-if-we-receive-an-invalid-dbus-message-ignore-.patch

c62b8e
From 1c53e6f5a6bf9ecd5196518fc824af22c6996141 Mon Sep 17 00:00:00 2001
5d65fd
From: Lennart Poettering <lennart@poettering.net>
5d65fd
Date: Wed, 13 Feb 2019 16:51:22 +0100
5d65fd
Subject: [PATCH] sd-bus: if we receive an invalid dbus message, ignore and
5d65fd
 proceeed
5d65fd
5d65fd
dbus-daemon might have a slightly different idea of what a valid msg is
5d65fd
than us (for example regarding valid msg and field sizes). Let's hence
5d65fd
try to proceed if we can and thus drop messages rather than fail the
5d65fd
connection if we fail to validate a message.
5d65fd
5d65fd
Hopefully the differences in what is considered valid are not visible
5d65fd
for real-life usecases, but are specific to exploit attempts only.
5d65fd
5d65fd
(cherry-picked from commit 6d586a13717ae057aa1b4127400c3de61cd5b9e7)
5d65fd
5d65fd
Related: #1667871
5d65fd
---
5d65fd
 src/libsystemd/sd-bus/bus-socket.c | 9 ++++++---
5d65fd
 1 file changed, 6 insertions(+), 3 deletions(-)
5d65fd
5d65fd
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
c62b8e
index ab56ef4f33..4437024bb9 100644
5d65fd
--- a/src/libsystemd/sd-bus/bus-socket.c
5d65fd
+++ b/src/libsystemd/sd-bus/bus-socket.c
5d65fd
@@ -879,7 +879,7 @@ static int bus_socket_read_message_need(sd_bus *bus, size_t *need) {
5d65fd
 }
5d65fd
 
5d65fd
 static int bus_socket_make_message(sd_bus *bus, size_t size) {
5d65fd
-        sd_bus_message *t;
5d65fd
+        sd_bus_message *t = NULL;
5d65fd
         void *b;
5d65fd
         int r;
5d65fd
 
5d65fd
@@ -905,7 +905,9 @@ static int bus_socket_make_message(sd_bus *bus, size_t size) {
5d65fd
                                     NULL,
5d65fd
                                     NULL,
5d65fd
                                     &t);
5d65fd
-        if (r < 0) {
5d65fd
+        if (r == -EBADMSG)
5d65fd
+                log_debug_errno(r, "Received invalid message from connection %s, dropping.", strna(bus->description));
5d65fd
+        else if (r < 0) {
5d65fd
                 free(b);
5d65fd
                 return r;
5d65fd
         }
5d65fd
@@ -916,7 +918,8 @@ static int bus_socket_make_message(sd_bus *bus, size_t size) {
5d65fd
         bus->fds = NULL;
5d65fd
         bus->n_fds = 0;
5d65fd
 
5d65fd
-        bus->rqueue[bus->rqueue_size++] = t;
5d65fd
+        if (t)
5d65fd
+                bus->rqueue[bus->rqueue_size++] = t;
5d65fd
 
5d65fd
         return 1;
5d65fd
 }