|
 |
4bff0a |
From a82cf4abc81722706b4466e65c1a05f997cf9fdc Mon Sep 17 00:00:00 2001
|
|
|
4bff0a |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
4bff0a |
Date: Mon, 9 Jul 2018 07:38:10 +0200
|
|
|
4bff0a |
Subject: [PATCH] bus-message: use structured initialization to avoid use of
|
|
|
4bff0a |
unitialized memory
|
|
|
4bff0a |
|
|
|
4bff0a |
As far as I can see, we would either reuse some values from a previously exited
|
|
|
4bff0a |
container or just random bytes from the heap.
|
|
|
4bff0a |
|
|
|
4bff0a |
Should fix #10127.
|
|
|
4bff0a |
|
|
|
4bff0a |
(cherry picked from commit cf81c68e96aa29d0c28b5d3a26d1de9aa1b53b85)
|
|
|
4bff0a |
|
|
|
4bff0a |
Resolves: #1696224
|
|
|
4bff0a |
---
|
|
|
4bff0a |
src/libsystemd/sd-bus/bus-message.c | 59 +++++++++++++----------------
|
|
|
4bff0a |
1 file changed, 27 insertions(+), 32 deletions(-)
|
|
|
4bff0a |
|
|
|
4bff0a |
diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
|
|
|
4bff0a |
index 780c8c6185..7f87d018fb 100644
|
|
|
4bff0a |
--- a/src/libsystemd/sd-bus/bus-message.c
|
|
|
4bff0a |
+++ b/src/libsystemd/sd-bus/bus-message.c
|
|
|
4bff0a |
@@ -1956,7 +1956,7 @@ _public_ int sd_bus_message_open_container(
|
|
|
4bff0a |
char type,
|
|
|
4bff0a |
const char *contents) {
|
|
|
4bff0a |
|
|
|
4bff0a |
- struct bus_container *c, *w;
|
|
|
4bff0a |
+ struct bus_container *c;
|
|
|
4bff0a |
uint32_t *array_size = NULL;
|
|
|
4bff0a |
_cleanup_free_ char *signature = NULL;
|
|
|
4bff0a |
size_t before, begin = 0;
|
|
|
4bff0a |
@@ -2001,17 +2001,14 @@ _public_ int sd_bus_message_open_container(
|
|
|
4bff0a |
return r;
|
|
|
4bff0a |
|
|
|
4bff0a |
/* OK, let's fill it in */
|
|
|
4bff0a |
- w = m->containers + m->n_containers++;
|
|
|
4bff0a |
- w->enclosing = type;
|
|
|
4bff0a |
- w->signature = TAKE_PTR(signature);
|
|
|
4bff0a |
- w->peeked_signature = NULL;
|
|
|
4bff0a |
- w->index = 0;
|
|
|
4bff0a |
- w->array_size = array_size;
|
|
|
4bff0a |
- w->before = before;
|
|
|
4bff0a |
- w->begin = begin;
|
|
|
4bff0a |
- w->n_offsets = w->offsets_allocated = 0;
|
|
|
4bff0a |
- w->offsets = NULL;
|
|
|
4bff0a |
- w->need_offsets = need_offsets;
|
|
|
4bff0a |
+ m->containers[m->n_containers++] = (struct bus_container) {
|
|
|
4bff0a |
+ .enclosing = type,
|
|
|
4bff0a |
+ .signature = TAKE_PTR(signature),
|
|
|
4bff0a |
+ .array_size = array_size,
|
|
|
4bff0a |
+ .before = before,
|
|
|
4bff0a |
+ .begin = begin,
|
|
|
4bff0a |
+ .need_offsets = need_offsets,
|
|
|
4bff0a |
+ };
|
|
|
4bff0a |
|
|
|
4bff0a |
return 0;
|
|
|
4bff0a |
}
|
|
|
4bff0a |
@@ -3980,10 +3977,10 @@ static int bus_message_enter_dict_entry(
|
|
|
4bff0a |
_public_ int sd_bus_message_enter_container(sd_bus_message *m,
|
|
|
4bff0a |
char type,
|
|
|
4bff0a |
const char *contents) {
|
|
|
4bff0a |
- struct bus_container *c, *w;
|
|
|
4bff0a |
+ struct bus_container *c;
|
|
|
4bff0a |
uint32_t *array_size = NULL;
|
|
|
4bff0a |
_cleanup_free_ char *signature = NULL;
|
|
|
4bff0a |
- size_t before;
|
|
|
4bff0a |
+ size_t before, end;
|
|
|
4bff0a |
_cleanup_free_ size_t *offsets = NULL;
|
|
|
4bff0a |
size_t n_offsets = 0, item_size = 0;
|
|
|
4bff0a |
int r;
|
|
|
4bff0a |
@@ -4062,28 +4059,26 @@ _public_ int sd_bus_message_enter_container(sd_bus_message *m,
|
|
|
4bff0a |
return r;
|
|
|
4bff0a |
|
|
|
4bff0a |
/* OK, let's fill it in */
|
|
|
4bff0a |
- w = m->containers + m->n_containers++;
|
|
|
4bff0a |
- w->enclosing = type;
|
|
|
4bff0a |
- w->signature = TAKE_PTR(signature);
|
|
|
4bff0a |
- w->peeked_signature = NULL;
|
|
|
4bff0a |
- w->index = 0;
|
|
|
4bff0a |
-
|
|
|
4bff0a |
- w->before = before;
|
|
|
4bff0a |
- w->begin = m->rindex;
|
|
|
4bff0a |
-
|
|
|
4bff0a |
- /* Unary type has fixed size of 1, but virtual size of 0 */
|
|
|
4bff0a |
if (BUS_MESSAGE_IS_GVARIANT(m) &&
|
|
|
4bff0a |
type == SD_BUS_TYPE_STRUCT &&
|
|
|
4bff0a |
isempty(signature))
|
|
|
4bff0a |
- w->end = m->rindex + 0;
|
|
|
4bff0a |
+ end = m->rindex + 0;
|
|
|
4bff0a |
else
|
|
|
4bff0a |
- w->end = m->rindex + c->item_size;
|
|
|
4bff0a |
-
|
|
|
4bff0a |
- w->array_size = array_size;
|
|
|
4bff0a |
- w->item_size = item_size;
|
|
|
4bff0a |
- w->offsets = TAKE_PTR(offsets);
|
|
|
4bff0a |
- w->n_offsets = n_offsets;
|
|
|
4bff0a |
- w->offset_index = 0;
|
|
|
4bff0a |
+ end = m->rindex + c->item_size;
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ m->containers[m->n_containers++] = (struct bus_container) {
|
|
|
4bff0a |
+ .enclosing = type,
|
|
|
4bff0a |
+ .signature = TAKE_PTR(signature),
|
|
|
4bff0a |
+
|
|
|
4bff0a |
+ .before = before,
|
|
|
4bff0a |
+ .begin = m->rindex,
|
|
|
4bff0a |
+ /* Unary type has fixed size of 1, but virtual size of 0 */
|
|
|
4bff0a |
+ .end = end,
|
|
|
4bff0a |
+ .array_size = array_size,
|
|
|
4bff0a |
+ .item_size = item_size,
|
|
|
4bff0a |
+ .offsets = TAKE_PTR(offsets),
|
|
|
4bff0a |
+ .n_offsets = n_offsets,
|
|
|
4bff0a |
+ };
|
|
|
4bff0a |
|
|
|
4bff0a |
return 1;
|
|
|
4bff0a |
}
|