From c49c8331b978440434b9667582f087226c301eb5 Mon Sep 17 00:00:00 2001 From: Mike Yuan Date: Tue, 27 Jan 2026 19:10:41 +0100 Subject: [PATCH] sd-bus/bus-message: more prudently verify it's SCM_RIGHTS that got truncated Follow-up for 6c8de404c98fb9b965cba68360c2db1e3f55b776 As discussed in https://github.com/systemd/systemd/pull/40089#issuecomment-3672063388, if any other control msg got truncated it's a genuine error, and we should reject the message as a whole. --- src/libsystemd/sd-bus/bus-message.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c index 9d71823b38f..69975c53711 100644 --- a/src/libsystemd/sd-bus/bus-message.c +++ b/src/libsystemd/sd-bus/bus-message.c @@ -4210,15 +4210,19 @@ static int message_parse_fields(sd_bus_message *m, bool got_ctrunc) { "Received a bus message with too many fds: %" PRIu32 " received vs. %" PRIu32 " declared", m->n_fds, n_unix_fds_declared); - if (m->n_fds < n_unix_fds_declared && !got_ctrunc) - return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), - "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared", - m->n_fds, n_unix_fds_declared); + if (m->n_fds < n_unix_fds_declared) { + if (!got_ctrunc) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), + "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared", + m->n_fds, n_unix_fds_declared); - if (got_ctrunc) log_error("Received a bus message with MSG_CTRUNC set with %" PRIu32 " fds received vs %" PRIu32 " declared", m->n_fds, n_unix_fds_declared); + } else if (got_ctrunc) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), + "Received a bus message with truncated control data, refusing."); + switch (m->header->type) { case SD_BUS_MESSAGE_SIGNAL: -- 2.47.3