Blob Blame History Raw
From 1d8e642b0b67f07b0bf469c25126b878380bae6a Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 17 Jan 2019 18:13:03 +0100
Subject: [PATCH] sd-bus: make rqueue/wqueue sizes of type size_t

Let's do this like we usually do and size arrays with size_t.

We already do this for the "allocated" counter correctly, and externally
we expose the queue sizes as uint64_t anyway, hence there's really no
point in usigned "unsigned" internally.

(cherry picked from commit 143d4e045a798ccc87889b2a8a60d7fbe44be441)
Related: CVE-2020-1712
---
 src/libsystemd/sd-bus/bus-internal.h | 4 ++--
 src/libsystemd/sd-bus/sd-bus.c       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
index 5d773b14c4..06bd7862cb 100644
--- a/src/libsystemd/sd-bus/bus-internal.h
+++ b/src/libsystemd/sd-bus/bus-internal.h
@@ -221,11 +221,11 @@ struct sd_bus {
         size_t rbuffer_size;
 
         sd_bus_message **rqueue;
-        unsigned rqueue_size;
+        size_t rqueue_size;
         size_t rqueue_allocated;
 
         sd_bus_message **wqueue;
-        unsigned wqueue_size;
+        size_t wqueue_size;
         size_t windex;
         size_t wqueue_allocated;
 
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
index 1c9e967ae0..64026f7ee1 100644
--- a/src/libsystemd/sd-bus/sd-bus.c
+++ b/src/libsystemd/sd-bus/sd-bus.c
@@ -2080,7 +2080,7 @@ _public_ int sd_bus_call(
         _cleanup_(sd_bus_message_unrefp) sd_bus_message *m = sd_bus_message_ref(_m);
         usec_t timeout;
         uint64_t cookie;
-        unsigned i;
+        size_t i;
         int r;
 
         bus_assert_return(m, -EINVAL, error);