diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2018-08-11 08:32:20 +0200 |
|---|---|---|
| committer | Sven Eden <sven.eden@prydeworx.com> | 2018-10-29 10:18:28 +0100 |
| commit | d3a477c6d3e601c91c3cd6dc41582f4fbc5c7745 (patch) | |
| tree | 11829bb10af63ef3e834bf8b072ab05e3914cf27 /src | |
| parent | 77e208790f8be9528ce9512a8ef36aff73f60fb9 (diff) | |
bus-message: fix skipping of array fields in !gvariant messages
We copied part of the string into a buffer that was off by two.
If the element signature had length one, we'd copy 0 bytes and crash when
looking at the "first" byte. Otherwise, we would crash because strncpy would
not terminate the string.
(cherry picked from commit 73777ddba5100fe6c0791cd37a91f24a515f3202)
Diffstat (limited to 'src')
| -rw-r--r-- | src/libelogind/sd-bus/bus-message.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/libelogind/sd-bus/bus-message.c b/src/libelogind/sd-bus/bus-message.c index f9ac754d3..5c1e9417b 100644 --- a/src/libelogind/sd-bus/bus-message.c +++ b/src/libelogind/sd-bus/bus-message.c @@ -4988,18 +4988,18 @@ static int message_skip_fields( } else if (t == SD_BUS_TYPE_ARRAY) { - r = signature_element_length(*signature+1, &l); + r = signature_element_length(*signature + 1, &l); if (r < 0) return r; assert(l >= 1); { - char sig[l-1], *s; + char sig[l + 1], *s = sig; uint32_t nas; int alignment; - strncpy(sig, *signature + 1, l-1); - s = sig; + strncpy(sig, *signature + 1, l); + sig[l] = '\0'; alignment = bus_type_get_alignment(sig[0]); if (alignment < 0) |