From 5eb96e51ca2ce0e90e90ecb9f78e8305f51fa5dd Mon Sep 17 00:00:00 2001 From: Riccardo Schirone Date: Mon, 4 Feb 2019 14:29:28 +0100 Subject: [PATCH] Allocate temporary strings to hold dbus paths on the heap Paths are limited to BUS_PATH_SIZE_MAX but the maximum size is anyway too big to be allocated on the stack, so let's switch to the heap where there is a clear way to understand if the allocation fails. (cherry-picked from commit f519a19bcd5afe674a9b8fc462cd77d8bad403c1) Related: #1678641 --- src/libsystemd/sd-bus/bus-objects.c | 68 +++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 14 deletions(-) diff --git a/src/libsystemd/sd-bus/bus-objects.c b/src/libsystemd/sd-bus/bus-objects.c index a18ff88b07..53bf0fd620 100644 --- a/src/libsystemd/sd-bus/bus-objects.c +++ b/src/libsystemd/sd-bus/bus-objects.c @@ -1134,7 +1134,8 @@ static int object_manager_serialize_path_and_fallbacks( const char *path, sd_bus_error *error) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -1150,7 +1151,12 @@ static int object_manager_serialize_path_and_fallbacks( return 0; /* Second, add fallback vtables registered for any of the prefixes */ - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_manager_serialize_path(bus, reply, prefix, path, true, error); if (r < 0) @@ -1346,6 +1352,7 @@ static int object_find_and_run( } int bus_process_object(sd_bus *bus, sd_bus_message *m) { + _cleanup_free_ char *prefix = NULL; int r; size_t pl; bool found_object = false; @@ -1370,9 +1377,12 @@ int bus_process_object(sd_bus *bus, sd_bus_message *m) { assert(m->member); pl = strlen(m->path); - do { - char prefix[pl+1]; + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + do { bus->nodes_modified = false; r = object_find_and_run(bus, m, m->path, false, &found_object); @@ -1499,9 +1509,15 @@ static int bus_find_parent_object_manager(sd_bus *bus, struct node **out, const n = hashmap_get(bus->nodes, path); if (!n) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; + + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; - prefix = alloca(strlen(path) + 1); OBJECT_PATH_FOREACH_PREFIX(prefix, path) { n = hashmap_get(bus->nodes, prefix); if (n) @@ -2090,8 +2106,9 @@ _public_ int sd_bus_emit_properties_changed_strv( const char *interface, char **names) { + _cleanup_free_ char *prefix = NULL; bool found_interface = false; - char *prefix; + size_t pl; int r; assert_return(bus, -EINVAL); @@ -2112,6 +2129,12 @@ _public_ int sd_bus_emit_properties_changed_strv( BUS_DONT_DESTROY(bus); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + do { bus->nodes_modified = false; @@ -2121,7 +2144,6 @@ _public_ int sd_bus_emit_properties_changed_strv( if (bus->nodes_modified) continue; - prefix = alloca(strlen(path) + 1); OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = emit_properties_changed_on_interface(bus, prefix, path, interface, true, &found_interface, names); if (r != 0) @@ -2253,7 +2275,8 @@ static int object_added_append_all_prefix( static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *path) { _cleanup_set_free_ Set *s = NULL; - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2298,7 +2321,12 @@ static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *p if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_added_append_all_prefix(bus, m, s, prefix, path, true); if (r < 0) @@ -2437,7 +2465,8 @@ static int object_removed_append_all_prefix( static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char *path) { _cleanup_set_free_ Set *s = NULL; - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2469,7 +2498,12 @@ static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_removed_append_all_prefix(bus, m, s, prefix, path, true); if (r < 0) @@ -2619,7 +2653,8 @@ static int interfaces_added_append_one( const char *path, const char *interface) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2633,7 +2668,12 @@ static int interfaces_added_append_one( if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = interfaces_added_append_one_prefix(bus, m, prefix, path, interface, true); if (r != 0)