• Simon McVittie's avatar
    _dbus_read_socket_with_unix_fds: do not accept extra fds in cmsg padding · ee11ec12
    Simon McVittie authored
    This addresses CVE-2014-3635.
    
    If (*n_fds * sizeof (int) % sizeof (size_t)) is nonzero,
    then CMSG_SPACE (*n_fds * sizeof (int)) > CMSG_LEN (*n_fds * sizeof (int)
    because the SPACE includes padding to a size_t boundary, whereas the LEN
    does not. We have to allocate the SPACE. Previously, we told the kernel
    that the buffer size we wanted was the SPACE, not the LEN, which meant
    it was free to fill the padding with additional fds: on a 64-bit
    platform with 32-bit int, that's one extra fd, if *n_fds happens
    to be odd.
    
    This meant that a malicious sender could send exactly 1 fd too many,
    which would make us fail an assertion if enabled, or overrun a buffer
    by 1 fd otherwise.
    
    Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83622Reviewed-by: 's avatarAlban Crequy <alban.crequy@collabora.co.uk>
    ee11ec12
Name
Last commit
Last update
bus Loading commit data...
cmake Loading commit data...
dbus Loading commit data...
doc Loading commit data...
m4 Loading commit data...
test Loading commit data...
tools Loading commit data...
.gitignore Loading commit data...
.mailmap Loading commit data...
AUTHORS Loading commit data...
COPYING Loading commit data...
ChangeLog Loading commit data...
ChangeLog.pre-1-0 Loading commit data...
ChangeLog.pre-1-2 Loading commit data...
Doxyfile.in Loading commit data...
HACKING Loading commit data...
INSTALL Loading commit data...
Makefile.am Loading commit data...
Makefile.cvs Loading commit data...
NEWS Loading commit data...
NEWS.pre-1-0 Loading commit data...
NEWS.pre-1-2 Loading commit data...
README Loading commit data...
README.cmake Loading commit data...
README.cygwin Loading commit data...
README.launchd Loading commit data...
README.valgrind Loading commit data...
README.win Loading commit data...
README.wince Loading commit data...
autogen.sh Loading commit data...
cleanup-man-pages.sh Loading commit data...
configure.ac Loading commit data...
dbus-1-uninstalled.pc.in Loading commit data...
dbus-1.pc.in Loading commit data...