sd-bus: refuse to send messages with an invalid string

Prompted by aaf7b0e41105d7b7cf30912cdac32820f011a219 and
4804da58536ab7ad46178a03f4d2da49fd8e4ba2.

diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index 9719f97c028b82654e2822f7584795b6f7e9f7b8..e41ce9c1c1b74b9f56517488ebac802792550262 100644 (file)
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -1342,12 +1342,21 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
                  * into the empty string */
                 p = strempty(p);
 
-                _fallthrough_;
+                if (!utf8_is_valid(p))
+                        return -EINVAL;
+
+                align = 4;
+                sz = 4 + strlen(p) + 1;
+                break;
+
         case SD_BUS_TYPE_OBJECT_PATH:
 
                 if (!p)
                         return -EINVAL;
 
+                if (!object_path_is_valid(p))
+                        return -EINVAL;
+
                 align = 4;
                 sz = 4 + strlen(p) + 1;
                 break;
@@ -1356,6 +1365,9 @@ int message_append_basic(sd_bus_message *m, char type, const void *p, const void
 
                 p = strempty(p);
 
+                if (!signature_is_valid(p, /* allow_dict_entry = */ true))
+                        return -EINVAL;
+
                 align = 1;
                 sz = 1 + strlen(p) + 1;
                 break;