SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sd-bus: avoid overflow in sd_bus_message_append_{array,string}_memfd()

Browse Source 
This also adds missing size == 0 check, and uses TAKE_FD().

(cherry picked from commit 9e84b6bea4156b8a417419730ff3a04c7e1e0375)
This commit is contained in:
Yu Watanabe
2026-10-16 17:24:51 +01:00
committed by Luca Boccassi
parent e8d4909b44
commit c31aa959f3
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-bus/bus-message.c
+13 -6
View File
@@ -2218,7 +2218,7 @@ _public_ int sd_bus_message_append_array_memfd(
if (offset == 0 && size == UINT64_MAX)
size = real_size;
else if (offset + size > real_size)
else if (size > real_size || offset > real_size - size)
return -EMSGSIZE;
align = bus_type_get_alignment(type);
@@ -2233,6 +2233,9 @@ _public_ int sd_bus_message_append_array_memfd(
if (size % sz != 0)
return -EINVAL;
if (size == 0)
return -EINVAL;
if (size > (uint64_t) UINT32_MAX)
return -EINVAL;
@@ -2248,11 +2251,13 @@ _public_ int sd_bus_message_append_array_memfd(
if (!part)
return -ENOMEM;
part->memfd = copy_fd;
if (m->body_size > UINT32_MAX - size)
return -EMSGSIZE;
part->memfd = TAKE_FD(copy_fd);
part->memfd_offset = offset;
part->sealed = true;
part->size = size;
copy_fd = -EBADF;
m->body_size += size;
message_extend_containers(m, size);
@@ -2293,7 +2298,7 @@ _public_ int sd_bus_message_append_string_memfd(
if (offset == 0 && size == UINT64_MAX)
size = real_size;
else if (offset + size > real_size)
else if (size > real_size || offset > real_size - size)
return -EMSGSIZE;
/* We require this to be NUL terminated */
@@ -2333,11 +2338,13 @@ _public_ int sd_bus_message_append_string_memfd(
if (!part)
return -ENOMEM;
part->memfd = copy_fd;
if (m->body_size > UINT32_MAX - size)
return -EMSGSIZE;
part->memfd = TAKE_FD(copy_fd);
part->memfd_offset = offset;
part->sealed = true;
part->size = size;
copy_fd = -EBADF;
m->body_size += size;
message_extend_containers(m, size);