Armaan Sandhu
559c4bfdc0
Data and field objects are only ever appended, and a new object is always linked after the current tail of its hash chain, so a valid next_hash_offset is either 0 or larger than the offset of the object itself. A new data object is also prepended to the list of data objects of its field, so a valid next_field_offset is always smaller than the offset of the object itself. Nothing checks either of these when an object is read, so if a chain loops back on itself, everything that walks it loops forever: - "journalctl --verify" spins in data_object_in_hash_table() instead of reporting the file as corrupted, - journal_file_punch_holes() never returns when the file is archived, so it is never offlined, - sd_journal_enumerate_fields() returns the same field over and over, so "journalctl --fields" never finishes, - sd_journal_enumerate_unique() returns the same value over and over, so "journalctl -F FIELD" never finishes. A single flipped bit in next_hash_offset or next_field_offset is enough for any of these. Check both in check_object(), like we already do for next_entry_array_offset, so that all readers are covered. (cherry picked from commit a1bf29afbeed5e4c702f58ea5a9038e433c99c11)
System and Service Manager
Details
Most documentation is available on systemd's website.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release