From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Tue, 6 Oct 2015 11:43:22 +0000 (+0100)
Subject: BecomeMonitor: do not overwrite error with another error
X-Git-Tag: dbus-1.10.2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7ee5f2b53a97d3b681f50748a00d10a2834231ed;p=thirdparty%2Fdbus.git

BecomeMonitor: do not overwrite error with another error

If the user gave us a syntactically invalid error name, we'd
overwrite the MatchRuleInvalid error with NoMemory, causing an
assertion failure (crash) in the dbus-daemon.

This is not a denial-of-service vulnerability on the system bus,
because monitoring is a privileged action, and root privilege
is checked before this code is reached. However, it's an annoying
bug on the session bus.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92298
Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
---

diff --git a/bus/driver.c b/bus/driver.c
index 379a47ee2..852ac536d 100644
--- a/bus/driver.c
+++ b/bus/driver.c
@@ -2006,10 +2006,7 @@ bus_driver_handle_become_monitor (DBusConnection *connection,
       rule = bus_match_rule_parse (connection, &str, error);
 
       if (rule == NULL)
-        {
-          BUS_SET_OOM (error);
-          goto out;
-        }
+        goto out;
 
       /* monitors always eavesdrop */
       bus_match_rule_set_client_is_eavesdropping (rule, TRUE);