From 16325b35fa6ecb25f66534a562583ce3b96d52f3 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 6 Mar 2026 19:32:35 +0000 Subject: [PATCH 1/3] udev: check for invalid chars in various fields received from the kernel --- src/udev/dmi_memory_id/dmi_memory_id.c | 3 ++- src/udev/scsi_id/scsi_id.c | 5 +++-- src/udev/udev-builtin-net_id.c | 9 +++++++++ src/udev/v4l_id/v4l_id.c | 5 ++++- 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/src/udev/dmi_memory_id/dmi_memory_id.c b/src/udev/dmi_memory_id/dmi_memory_id.c index 9475edcd54..a2f2ed7263 100644 --- a/src/udev/dmi_memory_id/dmi_memory_id.c +++ b/src/udev/dmi_memory_id/dmi_memory_id.c @@ -52,6 +52,7 @@ #include "string-util.h" #include "udev-util.h" #include "unaligned.h" +#include "utf8.h" #define SUPPORTED_SMBIOS_VER 0x030300 @@ -186,7 +187,7 @@ static void dmi_memory_device_string( str = strdupa_safe(dmi_string(h, s)); str = strstrip(str); - if (!isempty(str)) + if (!isempty(str) && utf8_is_valid(str) && !string_has_cc(str, /* ok= */ NULL)) printf("MEMORY_DEVICE_%u_%s=%s\n", slot_num, attr_suffix, str); } diff --git a/src/udev/scsi_id/scsi_id.c b/src/udev/scsi_id/scsi_id.c index 5216455f41..b57f31b593 100644 --- a/src/udev/scsi_id/scsi_id.c +++ b/src/udev/scsi_id/scsi_id.c @@ -20,6 +20,7 @@ #include "strv.h" #include "strxcpyx.h" #include "udev-util.h" +#include "utf8.h" static const struct option options[] = { { "device", required_argument, NULL, 'd' }, @@ -441,8 +442,8 @@ static int scsi_id(char *maj_min_dev) { } if (dev_scsi.tgpt_group[0] != '\0') printf("ID_TARGET_PORT=%s\n", dev_scsi.tgpt_group); - if (dev_scsi.unit_serial_number[0] != '\0') - printf("ID_SCSI_SERIAL=%s\n", dev_scsi.unit_serial_number); + if (dev_scsi.unit_serial_number[0] != '\0' && utf8_is_valid(dev_scsi.unit_serial_number) && !string_has_cc(dev_scsi.unit_serial_number, /* ok= */ NULL)) + printf("ID_SCSI_SERIAL=%s\n", serial_str); goto out; } diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c index d93849f332..f2a69a75d7 100644 --- a/src/udev/udev-builtin-net_id.c +++ b/src/udev/udev-builtin-net_id.c @@ -31,6 +31,7 @@ #include "stdio-util.h" #include "string-util.h" #include "udev-builtin.h" +#include "utf8.h" #define ONBOARD_14BIT_INDEX_MAX ((1U << 14) - 1) #define ONBOARD_16BIT_INDEX_MAX ((1U << 16) - 1) @@ -193,6 +194,9 @@ static int get_port_specifier(sd_device *dev, char **ret) { } } + if (!utf8_is_valid(phys_port_name) || string_has_cc(phys_port_name, /* ok= */ NULL)) + return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EINVAL), "Invalid phys_port_name"); + /* Otherwise, use phys_port_name as is. */ buf = strjoin("n", phys_port_name); if (!buf) @@ -297,6 +301,9 @@ static int names_pci_onboard_label(UdevEvent *event, sd_device *pci_dev, const c if (r < 0) return log_device_debug_errno(pci_dev, r, "Failed to get PCI onboard label: %m"); + if (!utf8_is_valid(label) || string_has_cc(label, /* ok= */ NULL)) + return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EINVAL), "Invalid label"); + char str[ALTIFNAMSIZ]; if (snprintf_ok(str, sizeof str, "%s%s", naming_scheme_has(NAMING_LABEL_NOPREFIX) ? "" : prefix, @@ -1247,6 +1254,8 @@ static int names_netdevsim(UdevEvent *event, const char *prefix) { if (isempty(phys_port_name)) return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EOPNOTSUPP), "The 'phys_port_name' attribute is empty."); + if (!utf8_is_valid(phys_port_name) || string_has_cc(phys_port_name, /* ok= */ NULL)) + return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EINVAL), "Invalid phys_port_name"); char str[ALTIFNAMSIZ]; if (snprintf_ok(str, sizeof str, "%si%un%s", prefix, addr, phys_port_name)) diff --git a/src/udev/v4l_id/v4l_id.c b/src/udev/v4l_id/v4l_id.c index 1e374c393c..dc4d41af2b 100644 --- a/src/udev/v4l_id/v4l_id.c +++ b/src/udev/v4l_id/v4l_id.c @@ -14,6 +14,8 @@ #include "fd-util.h" #include "log.h" #include "main-func.h" +#include "string-util.h" +#include "utf8.h" static const char *arg_device = NULL; @@ -72,7 +74,8 @@ static int run(int argc, char *argv[]) { int capabilities; printf("ID_V4L_VERSION=2\n"); - printf("ID_V4L_PRODUCT=%s\n", v2cap.card); + if (utf8_is_valid((char *)v2cap.card) && !string_has_cc((char *)v2cap.card, /* ok= */ NULL)) + printf("ID_V4L_PRODUCT=%s\n", v2cap.card); printf("ID_V4L_CAPABILITIES=:"); if (v2cap.capabilities & V4L2_CAP_DEVICE_CAPS) From 69e4ba69d689748d1d515c5a8d063073df3c5821 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 6 Mar 2026 19:42:16 +0000 Subject: [PATCH 2/3] udev: ensure there is space for trailing NUL before calling sprintf sprintf will write 5 characters, as it adds a trailing NUL byte. Reported on yeswehack.com as: YWH-PGM9780-62 Follow-up for 8cfcf9980a3 --- src/basic/device-nodes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/basic/device-nodes.c b/src/basic/device-nodes.c index 8d4e38ec06..37af18fce4 100644 --- a/src/basic/device-nodes.c +++ b/src/basic/device-nodes.c @@ -6,6 +6,7 @@ #include "device-nodes.h" #include "path-util.h" +#include "stdio-util.h" #include "string-util.h" #include "utf8.h" @@ -38,10 +39,10 @@ int encode_devnode_name(const char *str, char *str_enc, size_t len) { } else if (str[i] == '\\' || !allow_listed_char_for_devnode(str[i], NULL)) { - if (len-j < 4) + if (len-j < 5) return -EINVAL; - sprintf(&str_enc[j], "\\x%02x", (unsigned char) str[i]); + assert_se(snprintf_ok(&str_enc[j], 5, "\\x%02x", (unsigned char) str[i])); j += 4; } else { From 45a200cd751fae382f4145760cf84fd181db1319 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 6 Mar 2026 20:25:05 +0000 Subject: [PATCH 3/3] udev: ensure tag parsing stays within bounds This cannot actually happen, but add a safety check nonetheless. Reported on yeswehack.com as: YWH-PGM9780-43 Follow-up for d7867b31836173d1a943ecb1cab6484536126411 --- src/udev/udev-builtin-path_id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/udev/udev-builtin-path_id.c b/src/udev/udev-builtin-path_id.c index 4db20e4a13..cdd8da3203 100644 --- a/src/udev/udev-builtin-path_id.c +++ b/src/udev/udev-builtin-path_id.c @@ -654,7 +654,7 @@ static void add_id_tag(UdevEvent *event, const char *path) { size_t i = 0; /* compose valid udev tag name */ - for (const char *p = path; *p; p++) { + for (const char *p = path; *p && i < sizeof(tag) - 1; p++) { if (ascii_isdigit(*p) || ascii_isalpha(*p) || *p == '-') {