daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
36e8a3
From 6abfec31acae53943896b309db4a09a1cecac9a3 Mon Sep 17 00:00:00 2001
36e8a3
From: Lennart Poettering <lennart@poettering.net>
36e8a3
Date: Wed, 17 Oct 2018 18:37:48 +0200
36e8a3
Subject: [PATCH] core: enforce a limit on STATUS= texts recvd from services
36e8a3
36e8a3
Let's better be safe than sorry, and put a limit on what we receive.
36e8a3
36e8a3
(cherry picked from commit 3eac1bcae9284fb8b18f4b82156c0e85ddb004e5)
36e8a3
36e8a3
Related: CVE-2018-15686
36e8a3
---
36e8a3
 src/core/service.c | 8 ++++++--
36e8a3
 src/core/service.h | 2 ++
36e8a3
 2 files changed, 8 insertions(+), 2 deletions(-)
36e8a3
36e8a3
diff --git a/src/core/service.c b/src/core/service.c
4bff0a
index db1356c417..db17221888 100644
36e8a3
--- a/src/core/service.c
36e8a3
+++ b/src/core/service.c
36e8a3
@@ -3549,8 +3549,12 @@ static void service_notify_message(
36e8a3
                 _cleanup_free_ char *t = NULL;
36e8a3
 
36e8a3
                 if (!isempty(e)) {
36e8a3
-                        if (!utf8_is_valid(e))
36e8a3
-                                log_unit_warning(u, "Status message in notification message is not UTF-8 clean.");
36e8a3
+                        /* Note that this size limit check is mostly paranoia: since the datagram size we are willing
36e8a3
+                         * to process is already limited to NOTIFY_BUFFER_MAX, this limit here should never be hit. */
36e8a3
+                        if (strlen(e) > STATUS_TEXT_MAX)
36e8a3
+                                log_unit_warning(u, "Status message overly long (%zu > %u), ignoring.", strlen(e), STATUS_TEXT_MAX);
36e8a3
+                        else if (!utf8_is_valid(e))
36e8a3
+                                log_unit_warning(u, "Status message in notification message is not UTF-8 clean, ignoring.");
36e8a3
                         else {
36e8a3
                                 t = strdup(e);
36e8a3
                                 if (!t)
36e8a3
diff --git a/src/core/service.h b/src/core/service.h
4bff0a
index 9c06e91883..a142b09f0d 100644
36e8a3
--- a/src/core/service.h
36e8a3
+++ b/src/core/service.h
36e8a3
@@ -202,3 +202,5 @@ const char* service_result_to_string(ServiceResult i) _const_;
36e8a3
 ServiceResult service_result_from_string(const char *s) _pure_;
36e8a3
 
36e8a3
 DEFINE_CAST(SERVICE, Service);
36e8a3
+
36e8a3
+#define STATUS_TEXT_MAX (16U*1024U)