Attachment 41050 Details for Bug 32321 – Detect deep nesting during validation

[patch] Detect deep nesting during validation

0002-When-validating-reject-overly-deep-nesting-of-values.patch (text/plain), 3.74 KB, created by Havoc Pennington on 2010-12-12 18:39:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Havoc Pennington

Created: 2010-12-12 18:39:15 UTC

Size: 3.74 KB

patch

obsolete

>From 167e76d571f5f490f07a1d739f703d4e4dd31be9 Mon Sep 17 00:00:00 2001
>From: Havoc Pennington <hp@pobox.com>
>Date: Sun, 12 Dec 2010 21:34:53 -0500
>Subject: [PATCH 2/2] When validating, reject overly deep nesting of values
>
>We rejected deep nesting in the signature already, but
>with variants you could nest with a signature that
>was just "v"
>
>https://bugs.freedesktop.org/show_bug.cgi?id=32321
>---
> dbus/dbus-marshal-validate.c |   28 ++++++++++++++++++++++++----
> 1 files changed, 24 insertions(+), 4 deletions(-)
>
>diff --git a/dbus/dbus-marshal-validate.c b/dbus/dbus-marshal-validate.c
>index b5d7dae..b457997 100644
>--- a/dbus/dbus-marshal-validate.c
>+++ b/dbus/dbus-marshal-validate.c
>@@ -291,16 +291,30 @@ out:
>   return result;
> }
> 
>+/* note: this function is also used to validate the header's values,
>+ * since the header is a valid body with a particular signature.
>+ */
> static DBusValidity
> validate_body_helper (DBusTypeReader       *reader,
>                       int                   byte_order,
>                       dbus_bool_t           walk_reader_to_end,
>+                      int                   total_depth,
>                       const unsigned char  *p,
>                       const unsigned char  *end,
>                       const unsigned char **new_p)
> {
>   int current_type;
> 
>+  /* The spec allows arrays and structs to each nest 32, for total
>+   * nesting of 2*32. We want to impose the same limit on "dynamic"
>+   * value nesting (not visible in the signature) which is introduced
>+   * by DBUS_TYPE_VARIANT.
>+   */
>+  if (total_depth > (DBUS_MAXIMUM_TYPE_RECURSION_DEPTH * 2))
>+    {
>+      return DBUS_INVALID_NESTED_TOO_DEEPLY;
>+    }
>+
>   while ((current_type = _dbus_type_reader_get_current_type (reader)) != DBUS_TYPE_INVALID)
>     {
>       const unsigned char *a;
>@@ -477,7 +491,9 @@ validate_body_helper (DBusTypeReader       *reader,
>                   {
>                     while (p < array_end)
>                       {
>-                        validity = validate_body_helper (&sub, byte_order, FALSE, p, end, &p);
>+                        validity = validate_body_helper (&sub, byte_order, FALSE,
>+                                                         total_depth + 1,
>+                                                         p, end, &p);
>                         if (validity != DBUS_VALID)
>                           return validity;
>                       }
>@@ -594,7 +610,9 @@ validate_body_helper (DBusTypeReader       *reader,
> 
>             _dbus_assert (_dbus_type_reader_get_current_type (&sub) != DBUS_TYPE_INVALID);
> 
>-            validity = validate_body_helper (&sub, byte_order, FALSE, p, end, &p);
>+            validity = validate_body_helper (&sub, byte_order, FALSE,
>+                                             total_depth + 1,
>+                                             p, end, &p);
>             if (validity != DBUS_VALID)
>               return validity;
> 
>@@ -623,7 +641,9 @@ validate_body_helper (DBusTypeReader       *reader,
> 
>             _dbus_type_reader_recurse (reader, &sub);
> 
>-            validity = validate_body_helper (&sub, byte_order, TRUE, p, end, &p);
>+            validity = validate_body_helper (&sub, byte_order, TRUE,
>+                                             total_depth + 1,
>+                                             p, end, &p);
>             if (validity != DBUS_VALID)
>               return validity;
>           }
>@@ -708,7 +728,7 @@ _dbus_validate_body_with_reason (const DBusString *expected_signature,
>   p = _dbus_string_get_const_data_len (value_str, value_pos, len);
>   end = p + len;
> 
>-  validity = validate_body_helper (&reader, byte_order, TRUE, p, end, &p);
>+  validity = validate_body_helper (&reader, byte_order, TRUE, 0, p, end, &p);
>   if (validity != DBUS_VALID)
>     return validity;
>   
>-- 
>1.7.1
>

Actions: View | Splinter Review

Attachments on bug 32321: 41018 | 41049 | 41050 | 41245

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.