Skip to content

Commit

Permalink
sd-bus: if we receive an invalid dbus message, ignore and proceeed
Browse files Browse the repository at this point in the history
dbus-daemon might have a slightly different idea of what a valid msg is
than us (for example regarding valid msg and field sizes). Let's hence
try to proceed if we can and thus drop messages rather than fail the
connection if we fail to validate a message.

Hopefully the differences in what is considered valid are not visible
for real-life usecases, but are specific to exploit attempts only.
  • Loading branch information
poettering authored and keszybz committed Feb 14, 2019
1 parent dc9cced commit 6d586a1
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions src/libsystemd/sd-bus/bus-socket.c
Expand Up @@ -1072,7 +1072,7 @@ static int bus_socket_read_message_need(sd_bus *bus, size_t *need) {
}

static int bus_socket_make_message(sd_bus *bus, size_t size) {
sd_bus_message *t;
sd_bus_message *t = NULL;
void *b;
int r;

Expand All @@ -1097,7 +1097,9 @@ static int bus_socket_make_message(sd_bus *bus, size_t size) {
bus->fds, bus->n_fds,
NULL,
&t);
if (r < 0) {
if (r == -EBADMSG)
log_debug_errno(r, "Received invalid message from connection %s, dropping.", strna(bus->description));
else if (r < 0) {
free(b);
return r;
}
Expand All @@ -1108,7 +1110,8 @@ static int bus_socket_make_message(sd_bus *bus, size_t size) {
bus->fds = NULL;
bus->n_fds = 0;

bus->rqueue[bus->rqueue_size++] = t;
if (t)
bus->rqueue[bus->rqueue_size++] = t;

return 1;
}
Expand Down

0 comments on commit 6d586a1

Please sign in to comment.