From 9614dd542b76fdb1c0a4eac6ae5104b6e1b6b0da Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 9 Dec 2023 11:56:50 +0000 Subject: [PATCH 1/5] mount: check that MountParameters is valid before use Follow-up for 6c75eff6afd90 CID#1530430 --- src/core/mount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/mount.c b/src/core/mount.c index 654be17c47..ff97eebb59 100644 --- a/src/core/mount.c +++ b/src/core/mount.c @@ -1201,7 +1201,7 @@ static void mount_enter_mounting(Mount *m) { log_unit_warning_errno(UNIT(m), r, "Failed to create mount point '%s', ignoring: %m", m->where); /* If we are asked to create an OverlayFS, create the upper/work directories if they are missing */ - if (streq_ptr(p->fstype, "overlay")) { + if (p && streq_ptr(p->fstype, "overlay")) { _cleanup_strv_free_ char **dirs = NULL; r = fstab_filter_options( From 5572e9d82ffe2feef14d579eeedec8a86811e71c Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 9 Dec 2023 12:09:42 +0000 Subject: [PATCH 2/5] journal-remote: set upper length bound when parsing incoming headers CID#1529420 --- src/journal-remote/journal-gatewayd.c | 6 ++++++ src/journal-remote/journal-remote-main.c | 2 +- src/journal-remote/journal-remote.h | 3 +++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c index 9f0d0ec34a..ad1c46ac6c 100644 --- a/src/journal-remote/journal-gatewayd.c +++ b/src/journal-remote/journal-gatewayd.c @@ -22,6 +22,7 @@ #include "fileio.h" #include "glob-util.h" #include "hostname-util.h" +#include "journal-remote.h" #include "log.h" #include "logs-show.h" #include "main-func.h" @@ -431,6 +432,11 @@ static int request_parse_range( if (!range) return 0; + /* Safety upper bound to make Coverity happy. Apache2 has a default limit of 8KB: + * https://httpd.apache.org/docs/2.2/mod/core.html#limitrequestfieldsize */ + if (strlen(range) > JOURNAL_SERVER_MEMORY_MAX) + return -EINVAL; + m->n_skip = 0; range_after_eq = startswith(range, "entries="); if (range_after_eq) { diff --git a/src/journal-remote/journal-remote-main.c b/src/journal-remote/journal-remote-main.c index da0f20d3ce..6c09c068c8 100644 --- a/src/journal-remote/journal-remote-main.c +++ b/src/journal-remote/journal-remote-main.c @@ -374,7 +374,7 @@ static int setup_microhttpd_server(RemoteServer *s, { MHD_OPTION_EXTERNAL_LOGGER, (intptr_t) microhttpd_logger}, { MHD_OPTION_NOTIFY_COMPLETED, (intptr_t) request_meta_free}, { MHD_OPTION_LISTEN_SOCKET, fd}, - { MHD_OPTION_CONNECTION_MEMORY_LIMIT, 128*1024}, + { MHD_OPTION_CONNECTION_MEMORY_LIMIT, JOURNAL_SERVER_MEMORY_MAX}, { MHD_OPTION_END}, { MHD_OPTION_END}, { MHD_OPTION_END}, diff --git a/src/journal-remote/journal-remote.h b/src/journal-remote/journal-remote.h index 8d73f95dc9..1c0cde4db3 100644 --- a/src/journal-remote/journal-remote.h +++ b/src/journal-remote/journal-remote.h @@ -48,6 +48,9 @@ struct RemoteServer { }; extern RemoteServer *journal_remote_server_global; +/* Used for MHD_OPTION_CONNECTION_MEMORY_LIMIT and header parsing cap */ +#define JOURNAL_SERVER_MEMORY_MAX 128U * 1024U + int journal_remote_server_init( RemoteServer *s, const char *output, From fc9d7ddbacea48a70981231a5040307438a699c2 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 9 Dec 2023 12:58:48 +0000 Subject: [PATCH 3/5] systemctl: fix copy/paste on_circle is set twice to the same value CID#1529418 --- src/systemctl/systemctl-list-units.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/systemctl/systemctl-list-units.c b/src/systemctl/systemctl-list-units.c index a1482d40c2..184468ed61 100644 --- a/src/systemctl/systemctl-list-units.c +++ b/src/systemctl/systemctl-list-units.c @@ -135,7 +135,6 @@ static int output_units_list(const UnitInfo *unit_infos, size_t c) { if (streq(u->load_state, "not-found")) { on_circle = on_loaded = ansi_highlight_yellow(); - on_circle = ansi_highlight_yellow(); circle = true; } else if (STR_IN_SET(u->load_state, "bad-setting", "error", "masked")) { on_loaded = ansi_highlight_red(); From 2343f6b11e740f49b36b4c53e345ee26e48ba73f Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 9 Dec 2023 13:04:51 +0000 Subject: [PATCH 4/5] logind: use ASSERT_PTR to validate result before use handle_action_lookup() in general can return NULL, but not here as the handle is checked before, so add an assert. CID#1529415 CID#1529416 --- src/login/logind-action.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/login/logind-action.c b/src/login/logind-action.c index b9cb9b818d..e895107378 100644 --- a/src/login/logind-action.c +++ b/src/login/logind-action.c @@ -169,7 +169,7 @@ HandleAction handle_action_sleep_select(HandleActionSleepMask mask) { if (!FLAGS_SET(mask, a)) continue; - if (sleep_supported(handle_action_lookup(*i)->sleep_operation) > 0) + if (sleep_supported(ASSERT_PTR(handle_action_lookup(*i))->sleep_operation) > 0) return *i; } @@ -213,7 +213,7 @@ static int handle_action_execute( inhibit_what_to_string(m->delayed_action->inhibit_what), handle_action_to_string(handle)); - inhibit_operation = handle_action_lookup(handle)->inhibit_what; + inhibit_operation = ASSERT_PTR(handle_action_lookup(handle))->inhibit_what; /* If the actual operation is inhibited, warn and fail */ if (inhibit_what_is_valid(inhibit_operation) && From 3b3bce04f0992cbac72b9af07887c315476f5d66 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 9 Dec 2023 13:10:18 +0000 Subject: [PATCH 5/5] test-login: remove dead code HANDLE_SLEEP is == _HANDLE_ACTION_SLEEP_LAST and the loop is bounded by < _HANDLE_ACTION_SLEEP_LAST, so no need to check for it CID#1529414 --- src/login/test-login-tables.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/login/test-login-tables.c b/src/login/test-login-tables.c index e9ff3085ec..1278af7504 100644 --- a/src/login/test-login-tables.c +++ b/src/login/test-login-tables.c @@ -11,9 +11,6 @@ static void test_sleep_handle_action(void) { const HandleActionData *data; const char *sleep_operation_str, *handle_action_str; - if (action == HANDLE_SLEEP) - continue; - assert_se(data = handle_action_lookup(action)); assert_se(handle_action_str = handle_action_to_string(action));