c62b8e
From efecb8966520f1782501f8f5f05c89fde0c19deb Mon Sep 17 00:00:00 2001
5d65fd
From: Riccardo Schirone <rschiron@redhat.com>
5d65fd
Date: Mon, 4 Feb 2019 14:29:09 +0100
5d65fd
Subject: [PATCH] Refuse dbus message paths longer than BUS_PATH_SIZE_MAX
5d65fd
 limit.
5d65fd
5d65fd
Even though the dbus specification does not enforce any length limit on the
5d65fd
path of a dbus message, having to analyze too long strings in PID1 may be
5d65fd
time-consuming and it may have security impacts.
5d65fd
5d65fd
In any case, the limit is set so high that real-life applications should not
5d65fd
have a problem with it.
5d65fd
c62b8e
Related: #1667871
5d65fd
---
5d65fd
 src/libsystemd/sd-bus/bus-internal.c | 2 +-
5d65fd
 src/libsystemd/sd-bus/bus-internal.h | 4 ++++
5d65fd
 2 files changed, 5 insertions(+), 1 deletion(-)
5d65fd
5d65fd
diff --git a/src/libsystemd/sd-bus/bus-internal.c b/src/libsystemd/sd-bus/bus-internal.c
c62b8e
index 91b288cd25..c952d63e10 100644
5d65fd
--- a/src/libsystemd/sd-bus/bus-internal.c
5d65fd
+++ b/src/libsystemd/sd-bus/bus-internal.c
5d65fd
@@ -58,7 +58,7 @@ bool object_path_is_valid(const char *p) {
5d65fd
         if (slash)
5d65fd
                 return false;
5d65fd
 
5d65fd
-        return true;
5d65fd
+        return (q - p) <= BUS_PATH_SIZE_MAX;
5d65fd
 }
5d65fd
 
5d65fd
 char* object_path_startswith(const char *a, const char *b) {
5d65fd
diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
c62b8e
index 9c1e5a35b8..1c5fbeac2a 100644
5d65fd
--- a/src/libsystemd/sd-bus/bus-internal.h
5d65fd
+++ b/src/libsystemd/sd-bus/bus-internal.h
5d65fd
@@ -331,6 +331,10 @@ struct sd_bus {
5d65fd
 
5d65fd
 #define BUS_MESSAGE_SIZE_MAX (128*1024*1024)
5d65fd
 #define BUS_AUTH_SIZE_MAX (64*1024)
5d65fd
+/* Note that the D-Bus specification states that bus paths shall have no size limit. We enforce here one
5d65fd
+ * anyway, since truly unbounded strings are a security problem. The limit we pick is relatively large however,
5d65fd
+ * to not clash unnecessarily with real-life applications. */
5d65fd
+#define BUS_PATH_SIZE_MAX (64*1024)
5d65fd
 
5d65fd
 #define BUS_CONTAINER_DEPTH 128
5d65fd