602aa76cba
Fixes a family of OOB reads in the trie walker where attacker-controlled offsets are loaded from a (possibly hostile) hwdb.bin and added to hwdb->map without first checking that the resulting pointer stays inside the mapping. Crash sites: - trie_fnmatch_f sd-hwdb.c:187 (#42340) - trie_search_f sd-hwdb.c:233 (#42341) - trie_children_cmp_f /bsearch sd-hwdb.c:94 (#42342) - hwdb_add_property sd-hwdb.c:121 (#42343) - trie_node_from_off (UBSAN) sd-hwdb.c:83 - trie_fnmatch_f stack overflow on cyclic children (CIFuzz finding) Commitb45a897edc("hwdb: reject out-of-bounds fnmatch prefixes") plugged the first site only at the prefix_off-content level, but the crash on the read of node->prefix_off itself still happens when node is already OOB. This is the structural fix: a single hwdb_at() helper validates that [off, off + size) lies inside the mapping, and trie_node_from_off() / trie_string() return NULL on OOB; every caller treats the result as nullable and surfaces -EBADMSG. trie_fnmatch_f() additionally caps its recursion depth at 2048; without the cap a corrupt trie whose child offsets form a cycle (or just a deep linear chain) drives the parser into stack-overflow rather than returning -EBADMSG (caught by CIFuzz address sanitizer on this branch). Additions: - A fuzz-hwdb libFuzzer harness that drives sd_hwdb_new_from_path, sd_hwdb_get, sd_hwdb_seek, and sd_hwdb_enumerate on attacker bytes. - Five hand-crafted unit tests in test-sd-hwdb.c (one per crash bucket, plus the cyclic-trie recursion case) that build a malformed in-memory hwdb.bin and assert -EBADMSG rather than SIGSEGV / stack-overflow. - Regression corpus files under test/fuzz/fuzz-hwdb/ pinning each fixed bucket, including the CIFuzz stack-overflow reproducer. Closes #42340. Closes #42341. Closes #42342. Closes #42343. Reported-by: AI-assisted libFuzzer campaign Co-developed-by: Claude Opus 4.7 <noreply@anthropic.com> (cherry picked from commit73fea38cf1) (cherry picked from commita3189e6e3d)
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release