core: enforce a limit on STATUS= texts recvd from services

Let's better be safe than sorry, and put a limit on what we receive.

diff --git a/src/core/service.c b/src/core/service.c
index e3d7e4069f0ba2e3dda24e8241f203a70c135abb..2084b1c92873abe9a4b3e961e7440b68f20277e2 100644 (file)
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -3712,8 +3712,12 @@ static void service_notify_message(
                 _cleanup_free_ char *t = NULL;
 
                 if (!isempty(e)) {
-                        if (!utf8_is_valid(e))
-                                log_unit_warning(u, "Status message in notification message is not UTF-8 clean.");
+                        /* Note that this size limit check is mostly paranoia: since the datagram size we are willing
+                         * to process is already limited to NOTIFY_BUFFER_MAX, this limit here should never be hit. */
+                        if (strlen(e) > STATUS_TEXT_MAX)
+                                log_unit_warning(u, "Status message overly long (%zu > %u), ignoring.", strlen(e), STATUS_TEXT_MAX);
+                        else if (!utf8_is_valid(e))
+                                log_unit_warning(u, "Status message in notification message is not UTF-8 clean, ignoring.");
                         else {
                                 t = strdup(e);
                                 if (!t)

diff --git a/src/core/service.h b/src/core/service.h
index b53e4204e75519ac33612019e51a34fcccf6ecb5..1206e3cddae1d98b39c64ef041778c3f1d72ebca 100644 (file)
--- a/src/core/service.h
+++ b/src/core/service.h
@@ -206,3 +206,5 @@ const char* service_result_to_string(ServiceResult i) _const_;
 ServiceResult service_result_from_string(const char *s) _pure_;
 
 DEFINE_CAST(SERVICE, Service);
+
+#define STATUS_TEXT_MAX (16U*1024U)