SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sd-bus/bus-message: more prudently verify it's SCM_RIGHTS that got truncated

Browse Source 
Follow-up for 6c8de404c9

As discussed in
https://github.com/systemd/systemd/pull/40089#issuecomment-3672063388,
if any other control msg got truncated it's a genuine error, and
we should reject the message as a whole.
This commit is contained in:
Mike Yuan
2026-01-28 03:34:25 +01:00
parent f452c324e7
commit c49c8331b9
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-bus/bus-message.c
+9 -5
View File
@@ -4210,15 +4210,19 @@ static int message_parse_fields(sd_bus_message *m, bool got_ctrunc) {
"Received a bus message with too many fds: %" PRIu32 " received vs. %" PRIu32 " declared",
m->n_fds, n_unix_fds_declared);
if (m->n_fds < n_unix_fds_declared && !got_ctrunc)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
"Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
m->n_fds, n_unix_fds_declared);
if (m->n_fds < n_unix_fds_declared) {
if (!got_ctrunc)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
"Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
m->n_fds, n_unix_fds_declared);
if (got_ctrunc)
log_error("Received a bus message with MSG_CTRUNC set with %" PRIu32 " fds received vs %" PRIu32 " declared",
m->n_fds, n_unix_fds_declared);
} else if (got_ctrunc)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
"Received a bus message with truncated control data, refusing.");
switch (m->header->type) {
case SD_BUS_MESSAGE_SIGNAL: