summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/systemd/systemd/CVE-2019-6454.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-core/systemd/systemd/CVE-2019-6454.patch')
-rw-r--r--meta/recipes-core/systemd/systemd/CVE-2019-6454.patch210
1 files changed, 0 insertions, 210 deletions
diff --git a/meta/recipes-core/systemd/systemd/CVE-2019-6454.patch b/meta/recipes-core/systemd/systemd/CVE-2019-6454.patch
deleted file mode 100644
index 80170dac0f..0000000000
--- a/meta/recipes-core/systemd/systemd/CVE-2019-6454.patch
+++ /dev/null
@@ -1,210 +0,0 @@
-Description: sd-bus: enforce a size limit for dbus paths, and don't allocate
- them on the stacka
-Forwarded: no
-
-Patch from: systemd_239-7ubuntu10.8
-
-For information see:
-https://usn.ubuntu.com/3891-1/
-https://git.launchpad.net/ubuntu/+source/systemd/commit/?id=f8e75d5634904c8e672658856508c3a02f349adb
-
-CVE: CVE-2019-6454
-Upstream-Status: Backport
-
-Signed-off-by: George McCollister <george.mccollister@gmail.com>
-
---- a/src/libsystemd/sd-bus/bus-internal.c
-+++ b/src/libsystemd/sd-bus/bus-internal.c
-@@ -45,7 +45,7 @@
- if (slash)
- return false;
-
-- return true;
-+ return (q - p) <= BUS_PATH_SIZE_MAX;
- }
-
- char* object_path_startswith(const char *a, const char *b) {
---- a/src/libsystemd/sd-bus/bus-internal.h
-+++ b/src/libsystemd/sd-bus/bus-internal.h
-@@ -333,6 +333,10 @@
-
- #define BUS_MESSAGE_SIZE_MAX (128*1024*1024)
- #define BUS_AUTH_SIZE_MAX (64*1024)
-+/* Note that the D-Bus specification states that bus paths shall have no size limit. We enforce here one
-+ * anyway, since truly unbounded strings are a security problem. The limit we pick is relatively large however,
-+ * to not clash unnecessarily with real-life applications. */
-+#define BUS_PATH_SIZE_MAX (64*1024)
-
- #define BUS_CONTAINER_DEPTH 128
-
---- a/src/libsystemd/sd-bus/bus-objects.c
-+++ b/src/libsystemd/sd-bus/bus-objects.c
-@@ -1134,7 +1134,8 @@
- const char *path,
- sd_bus_error *error) {
-
-- char *prefix;
-+ _cleanup_free_ char *prefix = NULL;
-+ size_t pl;
- int r;
-
- assert(bus);
-@@ -1150,7 +1151,12 @@
- return 0;
-
- /* Second, add fallback vtables registered for any of the prefixes */
-- prefix = alloca(strlen(path) + 1);
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-+
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- r = object_manager_serialize_path(bus, reply, prefix, path, true, error);
- if (r < 0)
-@@ -1346,6 +1352,7 @@
- }
-
- int bus_process_object(sd_bus *bus, sd_bus_message *m) {
-+ _cleanup_free_ char *prefix = NULL;
- int r;
- size_t pl;
- bool found_object = false;
-@@ -1370,9 +1377,12 @@
- assert(m->member);
-
- pl = strlen(m->path);
-- do {
-- char prefix[pl+1];
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-
-+ do {
- bus->nodes_modified = false;
-
- r = object_find_and_run(bus, m, m->path, false, &found_object);
-@@ -1499,9 +1509,15 @@
-
- n = hashmap_get(bus->nodes, path);
- if (!n) {
-- char *prefix;
-+ _cleanup_free_ char *prefix = NULL;
-+ size_t pl;
-+
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-
-- prefix = alloca(strlen(path) + 1);
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- n = hashmap_get(bus->nodes, prefix);
- if (n)
-@@ -2091,8 +2107,9 @@
- char **names) {
-
- BUS_DONT_DESTROY(bus);
-+ _cleanup_free_ char *prefix = NULL;
- bool found_interface = false;
-- char *prefix;
-+ size_t pl;
- int r;
-
- assert_return(bus, -EINVAL);
-@@ -2111,6 +2128,12 @@
- if (names && names[0] == NULL)
- return 0;
-
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-+
- do {
- bus->nodes_modified = false;
-
-@@ -2120,7 +2143,6 @@
- if (bus->nodes_modified)
- continue;
-
-- prefix = alloca(strlen(path) + 1);
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- r = emit_properties_changed_on_interface(bus, prefix, path, interface, true, &found_interface, names);
- if (r != 0)
-@@ -2252,7 +2274,8 @@
-
- static int object_added_append_all(sd_bus *bus, sd_bus_message *m, const char *path) {
- _cleanup_set_free_ Set *s = NULL;
-- char *prefix;
-+ _cleanup_free_ char *prefix = NULL;
-+ size_t pl;
- int r;
-
- assert(bus);
-@@ -2297,7 +2320,12 @@
- if (bus->nodes_modified)
- return 0;
-
-- prefix = alloca(strlen(path) + 1);
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-+
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- r = object_added_append_all_prefix(bus, m, s, prefix, path, true);
- if (r < 0)
-@@ -2436,7 +2464,8 @@
-
- static int object_removed_append_all(sd_bus *bus, sd_bus_message *m, const char *path) {
- _cleanup_set_free_ Set *s = NULL;
-- char *prefix;
-+ _cleanup_free_ char *prefix = NULL;
-+ size_t pl;
- int r;
-
- assert(bus);
-@@ -2468,7 +2497,12 @@
- if (bus->nodes_modified)
- return 0;
-
-- prefix = alloca(strlen(path) + 1);
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-+
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- r = object_removed_append_all_prefix(bus, m, s, prefix, path, true);
- if (r < 0)
-@@ -2618,7 +2652,8 @@
- const char *path,
- const char *interface) {
-
-- char *prefix;
-+ _cleanup_free_ char *prefix = NULL;
-+ size_t pl;
- int r;
-
- assert(bus);
-@@ -2632,7 +2667,12 @@
- if (bus->nodes_modified)
- return 0;
-
-- prefix = alloca(strlen(path) + 1);
-+ pl = strlen(path);
-+ assert(pl <= BUS_PATH_SIZE_MAX);
-+ prefix = new(char, pl + 1);
-+ if (!prefix)
-+ return -ENOMEM;
-+
- OBJECT_PATH_FOREACH_PREFIX(prefix, path) {
- r = interfaces_added_append_one_prefix(bus, m, prefix, path, interface, true);
- if (r != 0)
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-26 01:20:15 +0000