diff options
| author | Simon McVittie <smcv@collabora.com> | 2022-09-12 13:14:18 +0100 |
|---|---|---|
| committer | Simon McVittie <smcv@collabora.com> | 2022-10-05 10:41:03 +0100 |
| commit | b9e6a7523085a2cfceaffca7ba1ab4251f12a984 (patch) | |
| tree | f4d09fd15dfbcc9acc89c3a8b65959aea8be57fb /test/data/invalid-messages/truncated-variant-sig.message-raw.hex | |
| parent | fd73d1ef1ba6ba4e55c07f5e65300bf40a94917f (diff) | |
| download | dbus-b9e6a7523085a2cfceaffca7ba1ab4251f12a984.tar.gz | |
dbus-marshal-validate: Validate length of arrays of fixed-length items
This fast-path previously did not check that the array was made up
of an integer number of items. This could lead to assertion failures
and out-of-bounds accesses during subsequent message processing (which
assumes that the message has already been validated), particularly after
the addition of _dbus_header_remove_unknown_fields(), which makes it
more likely that dbus-daemon will apply non-trivial edits to messages.
Thanks: Evgeny Vereshchagin
Fixes: e61f13cf "Bug 18064 - more efficient validation for fixed-size type arrays"
Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413
Resolves: CVE-2022-42011
Signed-off-by: Simon McVittie <smcv@collabora.com>
(cherry picked from commit 079bbf16186e87fb0157adf8951f19864bc2ed69)
Diffstat (limited to 'test/data/invalid-messages/truncated-variant-sig.message-raw.hex')
0 files changed, 0 insertions, 0 deletions