Zbigniew Jędrzejewski-Szmek
a88f9dbae2
When fuzzing, the following happens: - we parse 'data' and produce an argv array, - one of the items in argv is assigned to arg_host, - the argv array is subsequently freed by strv_freep(), and arg_host has a dangling symlink. In normal use, argv is static, so arg_host can never become a dangling pointer. In fuzz-systemctl-parse-argv, if we repeatedly parse the same array, we have some dangling pointers while we're in the middle of parsing. If we parse the same array a second time, at the end all the dangling pointers will have been replaced again. But for a short time, if parsing one of the arguments uses another argument, we would use a dangling pointer. Such a case occurs when we have --host=… --boot-loader-entry=help. The latter calls acquire_bus() which uses arg_host. I'm not particularly happy with making the code more complicated just for fuzzing, but I think it's better to resolve this, even if the issue cannot occur in normal invocations, than to deal with fuzzer reports. Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31714.
51 lines
1.6 KiB
C
51 lines
1.6 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include "bus-error.h"
|
|
#include "bus-locator.h"
|
|
#include "systemctl-kill.h"
|
|
#include "systemctl-util.h"
|
|
#include "systemctl.h"
|
|
|
|
int kill_unit(int argc, char *argv[], void *userdata) {
|
|
_cleanup_strv_free_ char **names = NULL;
|
|
char *kill_who = NULL, **name;
|
|
sd_bus *bus;
|
|
int r, q;
|
|
|
|
r = acquire_bus(BUS_MANAGER, &bus);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
polkit_agent_open_maybe();
|
|
|
|
if (!arg_kill_who)
|
|
arg_kill_who = "all";
|
|
|
|
/* --fail was specified */
|
|
if (streq(arg_job_mode(), "fail"))
|
|
kill_who = strjoina(arg_kill_who, "-fail");
|
|
|
|
r = expand_unit_names(bus, strv_skip(argv, 1), NULL, &names, NULL);
|
|
if (r < 0)
|
|
return log_error_errno(r, "Failed to expand names: %m");
|
|
|
|
STRV_FOREACH(name, names) {
|
|
_cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
|
|
|
|
q = bus_call_method(
|
|
bus,
|
|
bus_systemd_mgr,
|
|
"KillUnit",
|
|
&error,
|
|
NULL,
|
|
"ssi", *name, kill_who ? kill_who : arg_kill_who, arg_signal);
|
|
if (q < 0) {
|
|
log_error_errno(q, "Failed to kill unit %s: %s", *name, bus_error_message(&error, q));
|
|
if (r == 0)
|
|
r = q;
|
|
}
|
|
}
|
|
|
|
return r;
|
|
}
|