From 1f179b37f2de95ef4ecb61c1e566c7cd07f83afd Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 12 Jan 2024 04:44:48 +0900 Subject: [PATCH 1/2] json: add trailing NUL byte in json_dispatch_byte_array_iovec() For safety. Addresses https://github.com/systemd/systemd/pull/30879#discussion_r1448518226. --- src/shared/json.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/shared/json.c b/src/shared/json.c index 47cd78b3965..5bb447ba917 100644 --- a/src/shared/json.c +++ b/src/shared/json.c @@ -5007,7 +5007,7 @@ int json_dispatch_byte_array_iovec(const char *name, JsonVariant *variant, JsonD sz = json_variant_elements(variant); - buffer = new(uint8_t, sz); + buffer = new(uint8_t, sz + 1); if (!buffer) return json_log(variant, flags, SYNTHETIC_ERRNO(ENOMEM), "Out of memory."); @@ -5028,6 +5028,9 @@ int json_dispatch_byte_array_iovec(const char *name, JsonVariant *variant, JsonD } assert(k == sz); + /* Append a NUL byte for safety, like we do in memdup_suffix0() and others. */ + buffer[sz] = 0; + free_and_replace(iov->iov_base, buffer); iov->iov_len = sz; return 0; From 70c24d0d9fc4e16e30395a63552529e45d436c1b Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 12 Jan 2024 04:48:23 +0900 Subject: [PATCH 2/2] sd-netlink: add trailing NUL byte for safety in sd_netlink_message_read_data() Then, drop sd_netlink_message_read_data_suffix0(). --- src/libsystemd/sd-netlink/netlink-message.c | 26 --------------------- src/network/networkd-wifi.c | 2 +- src/shared/wifi-util.c | 2 +- src/systemd/sd-netlink.h | 1 - 4 files changed, 2 insertions(+), 29 deletions(-) diff --git a/src/libsystemd/sd-netlink/netlink-message.c b/src/libsystemd/sd-netlink/netlink-message.c index abe316b64bd..49d000d47e3 100644 --- a/src/libsystemd/sd-netlink/netlink-message.c +++ b/src/libsystemd/sd-netlink/netlink-message.c @@ -779,32 +779,6 @@ int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size assert_return(m, -EINVAL); - r = netlink_message_read_internal(m, attr_type, &attr_data, NULL); - if (r < 0) - return r; - - if (ret_data) { - void *data; - - data = memdup(attr_data, r); - if (!data) - return -ENOMEM; - - *ret_data = data; - } - - if (ret_size) - *ret_size = r; - - return r; -} - -int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data) { - void *attr_data; - int r; - - assert_return(m, -EINVAL); - r = netlink_message_read_internal(m, attr_type, &attr_data, NULL); if (r < 0) return r; diff --git a/src/network/networkd-wifi.c b/src/network/networkd-wifi.c index 98e7a72c1c7..ee63c3ec964 100644 --- a/src/network/networkd-wifi.c +++ b/src/network/networkd-wifi.c @@ -128,7 +128,7 @@ int manager_genl_process_nl80211_config(sd_netlink *genl, sd_netlink_message *me return 0; } - r = sd_netlink_message_read_data_suffix0(message, NL80211_ATTR_SSID, &len, (void**) &ssid); + r = sd_netlink_message_read_data(message, NL80211_ATTR_SSID, &len, (void**) &ssid); if (r < 0 && r != -ENODATA) { log_link_debug_errno(link, r, "nl80211: received %s(%u) message without valid SSID, ignoring: %m", strna(nl80211_cmd_to_string(cmd)), cmd); diff --git a/src/shared/wifi-util.c b/src/shared/wifi-util.c index d4e6dcac072..052f5606e53 100644 --- a/src/shared/wifi-util.c +++ b/src/shared/wifi-util.c @@ -55,7 +55,7 @@ int wifi_get_interface(sd_netlink *genl, int ifindex, enum nl80211_iftype *ret_i if (r < 0) return log_debug_errno(r, "Failed to get NL80211_ATTR_IFTYPE attribute: %m"); - r = sd_netlink_message_read_data_suffix0(reply, NL80211_ATTR_SSID, &len, (void**) &ssid); + r = sd_netlink_message_read_data(reply, NL80211_ATTR_SSID, &len, (void**) &ssid); if (r < 0 && r != -ENODATA) return log_debug_errno(r, "Failed to get NL80211_ATTR_SSID attribute: %m"); if (r >= 0) { diff --git a/src/systemd/sd-netlink.h b/src/systemd/sd-netlink.h index c35bfc47c96..240d21f9cad 100644 --- a/src/systemd/sd-netlink.h +++ b/src/systemd/sd-netlink.h @@ -106,7 +106,6 @@ int sd_netlink_message_cancel_array(sd_netlink_message *m); /* Reading messages */ int sd_netlink_message_read(sd_netlink_message *m, uint16_t attr_type, size_t size, void *data); int sd_netlink_message_read_data(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data); -int sd_netlink_message_read_data_suffix0(sd_netlink_message *m, uint16_t attr_type, size_t *ret_size, void **ret_data); int sd_netlink_message_read_string_strdup(sd_netlink_message *m, uint16_t attr_type, char **data); int sd_netlink_message_read_string(sd_netlink_message *m, uint16_t attr_type, const char **data); int sd_netlink_message_read_strv(sd_netlink_message *m, uint16_t container_type, uint16_t attr_type, char ***ret);