Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Maintenance:9687
systemd.openSUSE_Leap_15.0_Update
0001-systemd-PID1-crash-with-specially-crafted-...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-systemd-PID1-crash-with-specially-crafted-D-Bus-mess.patch of Package systemd.openSUSE_Leap_15.0_Update
From a933eb0be6d866e37cdf9a48e794ad1057b6aaf1 Mon Sep 17 00:00:00 2001 From: Chris Coulson <chris.coulson@canonical.com> Date: Wed, 13 Feb 2019 18:32:56 +0000 Subject: [PATCH 1/1] systemd (PID1) crash with specially crafted D-Bus message Fix for CVE-2019-6454 provided by Red Hat Product Security. Originally it applies to systemd master (tested as of https://github.com/systemd/systemd/commit/31cbd2025359e1e8435a2dc371e439591846d8c4). This patch will be replaced by its upstream version which will be available once this issue will be made public. [fbui: adjust context] [fbui: fixes bsc#1125352] [fbui: fixes CVE-2019-6454] --- src/libsystemd/sd-bus/bus-internal.c | 2 +- src/libsystemd/sd-bus/bus-internal.h | 4 ++ src/libsystemd/sd-bus/bus-objects.c | 68 ++++++++++++++++++++++------ 3 files changed, 59 insertions(+), 15 deletions(-) diff --git a/src/libsystemd/sd-bus/bus-internal.c b/src/libsystemd/sd-bus/bus-internal.c index caca679086..a388886f70 100644 --- a/src/libsystemd/sd-bus/bus-internal.c +++ b/src/libsystemd/sd-bus/bus-internal.c @@ -60,7 +60,7 @@ bool object_path_is_valid(const char *p) { if (slash) return false; - return true; + return (q - p) <= BUS_PATH_SIZE_MAX; } char* object_path_startswith(const char *a, const char *b) { diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h index 473f486c3d..b8bfb0004d 100644 --- a/src/libsystemd/sd-bus/bus-internal.h +++ b/src/libsystemd/sd-bus/bus-internal.h @@ -340,6 +340,10 @@ struct sd_bus { #define BUS_MESSAGE_SIZE_MAX (64*1024*1024) #define BUS_AUTH_SIZE_MAX (64*1024) +/* Note that the D-Bus specification states that bus paths shall have no size limit. We enforce here one + * anyway, since truly unbounded strings are a security problem. The limit we pick is relatively large however, + * to not clash unnecessarily with real-life applications. */ +#define BUS_PATH_SIZE_MAX (64*1024) #define BUS_CONTAINER_DEPTH 128 diff --git a/src/libsystemd/sd-bus/bus-objects.c b/src/libsystemd/sd-bus/bus-objects.c index 98911d5203..53aef75ebc 100644 --- a/src/libsystemd/sd-bus/bus-objects.c +++ b/src/libsystemd/sd-bus/bus-objects.c @@ -1145,7 +1145,8 @@ static int object_manager_serialize_path_and_fallbacks( const char *path, sd_bus_error *error) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -1161,7 +1162,12 @@ static int object_manager_serialize_path_and_fallbacks( return 0; /* Second, add fallback vtables registered for any of the prefixes */ - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_manager_serialize_path(bus, reply, prefix, path, true, error); if (r < 0) @@ -1357,6 +1363,7 @@ static int object_find_and_run( } int bus_process_object(sd_bus *bus, sd_bus_message *m) { + _cleanup_free_ char *prefix = NULL; int r; size_t pl; bool found_object = false; @@ -1381,9 +1388,12 @@ int bus_process_object(sd_bus *bus, sd_bus_message *m) { assert(m->member); pl = strlen(m->path); - do { - char prefix[pl+1]; + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + do { bus->nodes_modified = false; r = object_find_and_run(bus, m, m->path, false, &found_object); @@ -1512,9 +1522,15 @@ static int bus_find_parent_object_manager(sd_bus *bus, struct node **out, const n = hashmap_get(bus->nodes, path); if (!n) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; + + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; - prefix = alloca(strlen(path) + 1); OBJECT_PATH_FOREACH_PREFIX(prefix, path) { n = hashmap_get(bus->nodes, prefix); if (n) @@ -2102,8 +2118,9 @@ _public_ int sd_bus_emit_properties_changed_strv( char **names) { BUS_DONT_DESTROY(bus); + _cleanup_free_ char *prefix = NULL; bool found_interface = false; - char *prefix; + size_t pl; int r; assert_return(bus, -EINVAL); @@ -2121,6 +2138,12 @@ _public_ int sd_bus_emit_properties_changed_strv( if (names && names[0] == NULL) return 0; + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + do { bus->nodes_modified = false; @@ -2130,7 +2153,6 @@ _public_ int sd_bus_emit_properties_changed_strv( if (bus->nodes_modified) continue; - prefix = alloca(strlen(path) + 1); OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = emit_properties_changed_on_interface(bus, prefix, path, interface, true, &found_interface, names); if (r != 0) @@ -2261,7 +2283,8 @@ static int object_added_append_all_prefix( static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *path) { _cleanup_set_free_ Set *s = NULL; - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2306,7 +2329,12 @@ static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *p if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_added_append_all_prefix(bus, m, s, prefix, path, true); if (r < 0) @@ -2444,7 +2472,8 @@ static int object_removed_append_all_prefix( static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char *path) { _cleanup_set_free_ Set *s = NULL; - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2476,7 +2505,12 @@ static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = object_removed_append_all_prefix(bus, m, s, prefix, path, true); if (r < 0) @@ -2625,7 +2659,8 @@ static int interfaces_added_append_one( const char *path, const char *interface) { - char *prefix; + _cleanup_free_ char *prefix = NULL; + size_t pl; int r; assert(bus); @@ -2639,7 +2674,12 @@ static int interfaces_added_append_one( if (bus->nodes_modified) return 0; - prefix = alloca(strlen(path) + 1); + pl = strlen(path); + assert(pl <= BUS_PATH_SIZE_MAX); + prefix = new(char, pl + 1); + if (!prefix) + return -ENOMEM; + OBJECT_PATH_FOREACH_PREFIX(prefix, path) { r = interfaces_added_append_one_prefix(bus, m, prefix, path, interface, true); if (r != 0) -- 2.20.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
