From: Mike Yuan <me@yhndnzj.com>
Date: Tue, 27 Jan 2026 18:10:41 +0000 (+0100)
Subject: sd-bus/bus-message: more prudently verify it's SCM_RIGHTS that got truncated
X-Git-Tag: v260-rc1~306^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F40488%2Fhead;p=thirdparty%2Fsystemd.git

sd-bus/bus-message: more prudently verify it's SCM_RIGHTS that got truncated

Follow-up for 6c8de404c98fb9b965cba68360c2db1e3f55b776

As discussed in
https://github.com/systemd/systemd/pull/40089#issuecomment-3672063388,
if any other control msg got truncated it's a genuine error, and
we should reject the message as a whole.
---

diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index 9d71823b38f..69975c53711 100644
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -4210,15 +4210,19 @@ static int message_parse_fields(sd_bus_message *m, bool got_ctrunc) {
                                        "Received a bus message with too many fds: %" PRIu32 " received vs. %" PRIu32 " declared",
                                        m->n_fds, n_unix_fds_declared);
 
-        if (m->n_fds < n_unix_fds_declared && !got_ctrunc)
-                return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
-                                       "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
-                                       m->n_fds, n_unix_fds_declared);
+        if (m->n_fds < n_unix_fds_declared) {
+                if (!got_ctrunc)
+                        return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
+                                               "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
+                                               m->n_fds, n_unix_fds_declared);
 
-        if (got_ctrunc)
                 log_error("Received a bus message with MSG_CTRUNC set with %" PRIu32 " fds received vs %" PRIu32 " declared",
                           m->n_fds, n_unix_fds_declared);
 
+        } else if (got_ctrunc)
+                return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
+                                       "Received a bus message with truncated control data, refusing.");
+
         switch (m->header->type) {
 
         case SD_BUS_MESSAGE_SIGNAL: