luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-08-02 07:23:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

gdbusmessage: Check for valid GVariantType when parsing a variant blob

Browse Source 
The code was checking whether the signature provided by the blob was a
valid D-Bus signature — but that’s a superset of a valid GVariant type
string, since a D-Bus signature is zero or more complete types. A
GVariant type string is exactly one complete type.

This meant that a D-Bus message with a header field containing a variant
with an empty type signature (for example) could cause a critical
warning in the code parsing it.

Fix that by checking whether the string is a valid type string too.

Unit test included.

oss-fuzz#9810

Signed-off-by: Philip Withnall <withnall@endlessm.com>
This commit is contained in:
Philip Withnall
2018-09-18 15:17:44 +01:00
parent 968f1c6cad
commit e03d5a335b
2 changed files with 90 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
gio/gdbusmessage.c
View File

@@ -1846,8 +1846,11 @@ parse_value_from_blob (GMemoryBuffer *buf,
sig = read_string (buf, (gsize) siglen, &local_error);
if (sig == NULL)
goto fail;
if (!g_variant_is_signature (sig))
if (!g_variant_is_signature (sig) ||
!g_variant_type_string_is_valid (sig))
{
/* A D-Bus signature can contain zero or more complete types,
* but a GVariant has to be exactly one complete type. */
g_set_error (&local_error,
G_IO_ERROR,
G_IO_ERROR_INVALID_ARGUMENT,