From: Michal Sekletar <msekleta@redhat.com>
Date: Wed, 30 Oct 2024 13:55:09 +0000 (+0100)
Subject: coredump: allow only empty messages after first "sentinel"
X-Git-Tag: v257-rc1~89
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9fd1d37079b7e439d2a1a12994bdbc106015d03;p=thirdparty%2Fsystemd.git

coredump: allow only empty messages after first "sentinel"
---

diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 209d2548c24..dc725d1b22b 100644
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -1151,8 +1151,14 @@ static int process_socket(int fd) {
                         r = log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Received unexpected file descriptors.");
                         goto finish;
 
-                } else
-                        cmsg_close_all(&mh);
+                }
+                cmsg_close_all(&mh);
+
+                /* Only zero length messages are allowed after the first message that carried a file descriptor. */
+                if (!first) {
+                        r = log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Received unexpected message with non zero length.");
+                        goto finish;
+                }
 
                 /* Add trailing NUL byte, in case these are strings */
                 ((char*) iovec.iov_base)[n] = 0;