From 55354d5930fd0b7952d649d9ad5a850279fc73e1 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sat, 28 Mar 2026 21:11:48 +0000 Subject: [PATCH] sd-bus: add asserts for message size overflow safety Coverity flags arithmetic in BUS_MESSAGE_SIZE(), BUS_MESSAGE_BODY_BEGIN() and message_from_header() as potential overflows. The values are validated at message creation time, but add asserts to make the invariants explicit for static analyzers. CID#1548023 CID#1548030 CID#1548046 Follow-up for 6629161f827c82889cf45cfcdce62dcb543eda23 --- src/libsystemd/sd-bus/bus-message.c | 2 ++ src/libsystemd/sd-bus/bus-message.h | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c index c300d511ab..1f278db54e 100644 --- a/src/libsystemd/sd-bus/bus-message.c +++ b/src/libsystemd/sd-bus/bus-message.c @@ -362,6 +362,8 @@ static int message_from_header( if (label) { label_sz = strlen(label); + /* Silence static analyzers */ + assert(label_sz <= SIZE_MAX - ALIGN(sizeof(sd_bus_message)) - 1); a += label_sz + 1; } diff --git a/src/libsystemd/sd-bus/bus-message.h b/src/libsystemd/sd-bus/bus-message.h index c15e947fbf..fe9679393e 100644 --- a/src/libsystemd/sd-bus/bus-message.h +++ b/src/libsystemd/sd-bus/bus-message.h @@ -153,6 +153,9 @@ static inline uint64_t BUS_MESSAGE_COOKIE(sd_bus_message *m) { } static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) { + /* Silence static analyzers */ + assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader)); + assert(m->body_size <= SIZE_MAX - sizeof(BusMessageHeader) - ALIGN8(m->fields_size)); return sizeof(BusMessageHeader) + ALIGN8(m->fields_size) + @@ -160,6 +163,8 @@ static inline size_t BUS_MESSAGE_SIZE(sd_bus_message *m) { } static inline size_t BUS_MESSAGE_BODY_BEGIN(sd_bus_message *m) { + /* Silence static analyzers */ + assert(ALIGN8(m->fields_size) <= SIZE_MAX - sizeof(BusMessageHeader)); return sizeof(BusMessageHeader) + ALIGN8(m->fields_size);