From 4f174e49aef83d6cf009427297f3a282b8acbc17 Mon Sep 17 00:00:00 2001 From: Benjamin Robin Date: Sat, 9 May 2020 18:12:21 +0200 Subject: [PATCH] netlink: Fix assert condition on n_containers (cherry picked from commit 179b4db439ce4c41d44a6b5de22244c9ab54b252) --- src/libsystemd/sd-netlink/netlink-message.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/libsystemd/sd-netlink/netlink-message.c b/src/libsystemd/sd-netlink/netlink-message.c index 39e3c36ad2..2648b338f5 100644 --- a/src/libsystemd/sd-netlink/netlink-message.c +++ b/src/libsystemd/sd-netlink/netlink-message.c @@ -15,8 +15,7 @@ #include "socket-util.h" #include "strv.h" -#define GET_CONTAINER(m, i) ((i) < (m)->n_containers ? (struct rtattr*)((uint8_t*)(m)->hdr + (m)->containers[i].offset) : NULL) -#define PUSH_CONTAINER(m, new) (m)->container_offsets[(m)->n_containers++] = (uint8_t*)(new) - (uint8_t*)(m)->hdr; +#define GET_CONTAINER(m, i) ((struct rtattr*)((uint8_t*)(m)->hdr + (m)->containers[i].offset)) #define RTA_TYPE(rta) ((rta)->rta_type & NLA_TYPE_MASK) #define RTA_FLAGS(rta) ((rta)->rta_type & ~NLA_TYPE_MASK) @@ -452,7 +451,8 @@ int sd_netlink_message_open_container(sd_netlink_message *m, unsigned short type assert_return(m, -EINVAL); assert_return(!m->sealed, -EPERM); - assert_return(m->n_containers < RTNL_CONTAINER_DEPTH, -ERANGE); + /* m->containers[m->n_containers + 1] is accessed both in read and write. Prevent access out of bound */ + assert_return(m->n_containers < (RTNL_CONTAINER_DEPTH - 1), -ERANGE); r = message_attribute_has_type(m, &size, type, NETLINK_TYPE_NESTED); if (r < 0) { @@ -499,6 +499,7 @@ int sd_netlink_message_open_container_union(sd_netlink_message *m, unsigned shor assert_return(m, -EINVAL); assert_return(!m->sealed, -EPERM); + assert_return(m->n_containers < (RTNL_CONTAINER_DEPTH - 1), -ERANGE); r = type_system_get_type_system_union(m->containers[m->n_containers].type_system, &type_system_union, type); if (r < 0) @@ -541,6 +542,7 @@ int sd_netlink_message_open_array(sd_netlink_message *m, uint16_t type) { assert_return(m, -EINVAL); assert_return(!m->sealed, -EPERM); + assert_return(m->n_containers < (RTNL_CONTAINER_DEPTH - 1), -ERANGE); r = add_rtattr(m, type | NLA_F_NESTED, NULL, 0); if (r < 0) @@ -939,7 +941,7 @@ int sd_netlink_message_enter_container(sd_netlink_message *m, unsigned short typ int r; assert_return(m, -EINVAL); - assert_return(m->n_containers < RTNL_CONTAINER_DEPTH, -EINVAL); + assert_return(m->n_containers < (RTNL_CONTAINER_DEPTH - 1), -EINVAL); r = type_system_get_type(m->containers[m->n_containers].type_system, &nl_type, @@ -1030,7 +1032,7 @@ int sd_netlink_message_enter_array(sd_netlink_message *m, unsigned short type_id int r; assert_return(m, -EINVAL); - assert_return(m->n_containers < RTNL_CONTAINER_DEPTH, -EINVAL); + assert_return(m->n_containers < (RTNL_CONTAINER_DEPTH - 1), -EINVAL); r = netlink_message_read_internal(m, type_id, &container, NULL); if (r < 0) -- 2.25.1