daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
36e8a3
From 55a1c766445750aaefe28bd7bea454f5f1cff9bb Mon Sep 17 00:00:00 2001
36e8a3
From: Lennart Poettering <lennart@poettering.net>
36e8a3
Date: Wed, 17 Oct 2018 18:36:24 +0200
36e8a3
Subject: [PATCH] =?UTF-8?q?core:=20when=20deserializing=20state=20always?=
36e8a3
 =?UTF-8?q?=20use=20read=5Fline(=E2=80=A6,=20LONG=5FLINE=5FMAX,=20?=
36e8a3
 =?UTF-8?q?=E2=80=A6)?=
36e8a3
MIME-Version: 1.0
36e8a3
Content-Type: text/plain; charset=UTF-8
36e8a3
Content-Transfer-Encoding: 8bit
36e8a3
36e8a3
This should be much better than fgets(), as we can read substantially
36e8a3
longer lines and overly long lines result in proper errors.
36e8a3
36e8a3
Fixes a vulnerability discovered by Jann Horn at Google.
36e8a3
36e8a3
CVE-2018-15686
36e8a3
LP: #1796402
36e8a3
https://bugzilla.redhat.com/show_bug.cgi?id=1639071
36e8a3
36e8a3
(cherry picked from commit 8948b3415d762245ebf5e19d80b97d4d8cc208c1)
36e8a3
36e8a3
Resolves: CVE-2018-15686
36e8a3
---
36e8a3
 src/core/job.c     | 19 +++++++++++--------
36e8a3
 src/core/manager.c | 47 ++++++++++++++++++++--------------------------
36e8a3
 src/core/unit.c    | 34 +++++++++++++++++----------------
36e8a3
 src/core/unit.h    |  2 +-
36e8a3
 4 files changed, 50 insertions(+), 52 deletions(-)
36e8a3
36e8a3
diff --git a/src/core/job.c b/src/core/job.c
4bff0a
index 734756b666..8552ffb704 100644
36e8a3
--- a/src/core/job.c
36e8a3
+++ b/src/core/job.c
36e8a3
@@ -10,6 +10,7 @@
36e8a3
 #include "dbus-job.h"
36e8a3
 #include "dbus.h"
36e8a3
 #include "escape.h"
36e8a3
+#include "fileio.h"
36e8a3
 #include "job.h"
36e8a3
 #include "log.h"
36e8a3
 #include "macro.h"
36e8a3
@@ -1091,24 +1092,26 @@ int job_serialize(Job *j, FILE *f) {
36e8a3
 }
36e8a3
 
36e8a3
 int job_deserialize(Job *j, FILE *f) {
36e8a3
+        int r;
36e8a3
+
36e8a3
         assert(j);
36e8a3
         assert(f);
36e8a3
 
36e8a3
         for (;;) {
36e8a3
-                char line[LINE_MAX], *l, *v;
36e8a3
+                _cleanup_free_ char *line = NULL;
36e8a3
+                char *l, *v;
36e8a3
                 size_t k;
36e8a3
 
36e8a3
-                if (!fgets(line, sizeof(line), f)) {
36e8a3
-                        if (feof(f))
36e8a3
-                                return 0;
36e8a3
-                        return -errno;
36e8a3
-                }
36e8a3
+                r = read_line(f, LONG_LINE_MAX, &line);
36e8a3
+                if (r < 0)
36e8a3
+                        return log_error_errno(r, "Failed to read serialization line: %m");
36e8a3
+                if (r == 0)
36e8a3
+                        return 0;
36e8a3
 
36e8a3
-                char_array_0(line);
36e8a3
                 l = strstrip(line);
36e8a3
 
36e8a3
                 /* End marker */
36e8a3
-                if (l[0] == 0)
36e8a3
+                if (isempty(l))
36e8a3
                         return 0;
36e8a3
 
36e8a3
                 k = strcspn(l, "=");
36e8a3
diff --git a/src/core/manager.c b/src/core/manager.c
4bff0a
index 3b2fe11e87..c83e296cf3 100644
36e8a3
--- a/src/core/manager.c
36e8a3
+++ b/src/core/manager.c
36e8a3
@@ -3144,22 +3144,17 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
36e8a3
         m->n_reloading++;
36e8a3
 
36e8a3
         for (;;) {
36e8a3
-                char line[LINE_MAX];
36e8a3
+                _cleanup_free_ char *line = NULL;
36e8a3
                 const char *val, *l;
36e8a3
 
36e8a3
-                if (!fgets(line, sizeof(line), f)) {
36e8a3
-                        if (feof(f))
36e8a3
-                                r = 0;
36e8a3
-                        else
36e8a3
-                                r = -errno;
36e8a3
-
36e8a3
-                        goto finish;
36e8a3
-                }
36e8a3
+                r = read_line(f, LONG_LINE_MAX, &line);
36e8a3
+                if (r < 0)
36e8a3
+                        return log_error_errno(r, "Failed to read serialization line: %m");
36e8a3
+                if (r == 0)
36e8a3
+                        break;
36e8a3
 
36e8a3
-                char_array_0(line);
36e8a3
                 l = strstrip(line);
36e8a3
-
36e8a3
-                if (l[0] == 0)
36e8a3
+                if (isempty(l)) /* end marker */
36e8a3
                         break;
36e8a3
 
36e8a3
                 if ((val = startswith(l, "current-job-id="))) {
36e8a3
@@ -3326,29 +3321,27 @@ int manager_deserialize(Manager *m, FILE *f, FDSet *fds) {
36e8a3
         }
36e8a3
 
36e8a3
         for (;;) {
36e8a3
-                Unit *u;
36e8a3
-                char name[UNIT_NAME_MAX+2];
36e8a3
+                _cleanup_free_ char *line = NULL;
36e8a3
                 const char* unit_name;
36e8a3
+                Unit *u;
36e8a3
 
36e8a3
                 /* Start marker */
36e8a3
-                if (!fgets(name, sizeof(name), f)) {
36e8a3
-                        if (feof(f))
36e8a3
-                                r = 0;
36e8a3
-                        else
36e8a3
-                                r = -errno;
36e8a3
-
36e8a3
-                        goto finish;
36e8a3
-                }
36e8a3
+                r = read_line(f, LONG_LINE_MAX, &line);
36e8a3
+                if (r < 0)
36e8a3
+                        return log_error_errno(r, "Failed to read serialization line: %m");
36e8a3
+                if (r == 0)
36e8a3
+                        break;
36e8a3
 
36e8a3
-                char_array_0(name);
36e8a3
-                unit_name = strstrip(name);
36e8a3
+                unit_name = strstrip(line);
36e8a3
 
36e8a3
                 r = manager_load_unit(m, unit_name, NULL, NULL, &u);
36e8a3
                 if (r < 0) {
36e8a3
                         log_notice_errno(r, "Failed to load unit \"%s\", skipping deserialization: %m", unit_name);
36e8a3
-                        if (r == -ENOMEM)
36e8a3
-                                goto finish;
36e8a3
-                        unit_deserialize_skip(f);
36e8a3
+
36e8a3
+                        r = unit_deserialize_skip(f);
36e8a3
+                        if (r < 0)
36e8a3
+                                return r;
36e8a3
+
36e8a3
                         continue;
36e8a3
                 }
36e8a3
 
36e8a3
diff --git a/src/core/unit.c b/src/core/unit.c
4bff0a
index 721d8d60a3..cc43ddc4f1 100644
36e8a3
--- a/src/core/unit.c
36e8a3
+++ b/src/core/unit.c
36e8a3
@@ -3368,21 +3368,19 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
36e8a3
         assert(fds);
36e8a3
 
36e8a3
         for (;;) {
36e8a3
-                char line[LINE_MAX], *l, *v;
36e8a3
+                _cleanup_free_ char *line = NULL;
36e8a3
                 CGroupIPAccountingMetric m;
36e8a3
+                char *l, *v;
36e8a3
                 size_t k;
36e8a3
 
36e8a3
-                if (!fgets(line, sizeof(line), f)) {
36e8a3
-                        if (feof(f))
36e8a3
-                                return 0;
36e8a3
-                        return -errno;
36e8a3
-                }
36e8a3
+                r = read_line(f, LONG_LINE_MAX, &line);
36e8a3
+                if (r < 0)
36e8a3
+                        return log_error_errno(r, "Failed to read serialization line: %m");
36e8a3
+                if (r == 0) /* eof */
36e8a3
+                        break;
36e8a3
 
36e8a3
-                char_array_0(line);
36e8a3
                 l = strstrip(line);
36e8a3
-
36e8a3
-                /* End marker */
36e8a3
-                if (isempty(l))
36e8a3
+                if (isempty(l)) /* End marker */
36e8a3
                         break;
36e8a3
 
36e8a3
                 k = strcspn(l, "=");
36e8a3
@@ -3657,23 +3655,27 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
36e8a3
         return 0;
36e8a3
 }
36e8a3
 
36e8a3
-void unit_deserialize_skip(FILE *f) {
36e8a3
+int unit_deserialize_skip(FILE *f) {
36e8a3
+        int r;
36e8a3
         assert(f);
36e8a3
 
36e8a3
         /* Skip serialized data for this unit. We don't know what it is. */
36e8a3
 
36e8a3
         for (;;) {
36e8a3
-                char line[LINE_MAX], *l;
36e8a3
+                _cleanup_free_ char *line = NULL;
36e8a3
+                char *l;
36e8a3
 
36e8a3
-                if (!fgets(line, sizeof line, f))
36e8a3
-                        return;
36e8a3
+                r = read_line(f, LONG_LINE_MAX, &line);
36e8a3
+                if (r < 0)
36e8a3
+                        return log_error_errno(r, "Failed to read serialization line: %m");
36e8a3
+                if (r == 0)
36e8a3
+                        return 0;
36e8a3
 
36e8a3
-                char_array_0(line);
36e8a3
                 l = strstrip(line);
36e8a3
 
36e8a3
                 /* End marker */
36e8a3
                 if (isempty(l))
36e8a3
-                        return;
36e8a3
+                        return 1;
36e8a3
         }
36e8a3
 }
36e8a3
 
36e8a3
diff --git a/src/core/unit.h b/src/core/unit.h
4bff0a
index b3131eba1b..e1a60da244 100644
36e8a3
--- a/src/core/unit.h
36e8a3
+++ b/src/core/unit.h
36e8a3
@@ -679,7 +679,7 @@ bool unit_can_serialize(Unit *u) _pure_;
36e8a3
 
36e8a3
 int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs);
36e8a3
 int unit_deserialize(Unit *u, FILE *f, FDSet *fds);
36e8a3
-void unit_deserialize_skip(FILE *f);
36e8a3
+int unit_deserialize_skip(FILE *f);
36e8a3
 
36e8a3
 int unit_serialize_item(Unit *u, FILE *f, const char *key, const char *value);
36e8a3
 int unit_serialize_item_escaped(Unit *u, FILE *f, const char *key, const char *value);