hostnamed: after unescaping fancy name, validate it's valid UTF-8

The fancy name could contain arbitrary bytes, in escaped fashion. Before
using it, let's validate that this contains only valid UTF-8.

(Note that D-Bus might kick us off the bus if we don't ensure everything
we send around is UTF-8).

(While we are at it, do the same in PID 1, even though it's not that
important there)

Addresses this issue found by @YHNdnzj:

https://github.com/systemd/systemd/pull/40367#discussion_r2714614301

Follow-up for: #40367

diff --git a/src/core/main.c b/src/core/main.c
index 0e5e201f2dd757ff944631634b5222eee9b05965..687b397e62138758c486ba3f7daa14b9d650b550 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1422,6 +1422,9 @@ static int os_release_status(void) {
                         if (l < 0) {
                                 log_debug_errno(l, "Failed to unescape FANCY_NAME=, ignoring: %m");
                                 fancy_name = mfree(fancy_name);
+                        } else if (!utf8_is_valid(fancy_name)) {
+                                log_debug("Unescaped FANCY_NAME= contains invalid UTF-8, ignoring.");
+                                fancy_name = mfree(fancy_name);
                         } else {
                                 free_and_replace(fancy_name, unescaped);
 

diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index d2461981af20d60c258af069e7b557393f148494..fc1bab0f751ee8b55e3bded932de3a05bfee728f 100644 (file)
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -238,6 +238,9 @@ static void context_read_os_release(Context *c) {
                 if (l < 0) {
                         log_warning_errno(l, "Failed to unescape fancy OS name, ignoring: %m");
                         os_fancy_name = mfree(os_fancy_name);
+                } else if (!utf8_is_valid(unescaped)) {
+                        log_warning("Unescaped fancy OS name contains invalid UTF-8, ignoring.");
+                        os_fancy_name = mfree(os_fancy_name);
                 } else
                         free_and_replace(os_fancy_name, unescaped);
         }