]> git.ipfire.org Git - thirdparty/systemd.git/commit
hwdb: reject overlong fnmatch key instead of passing NULL to fnmatch()
authorLuca Boccassi <luca.boccassi@gmail.com>
Fri, 29 May 2026 11:37:31 +0000 (12:37 +0100)
committerLuca Boccassi <luca.boccassi@gmail.com>
Fri, 29 May 2026 16:21:31 +0000 (17:21 +0100)
commit3db89cbf0e27e3ef38a060c3c765367a700ad7f7
tree56d3059c8d425cfa872269acb6a286c5967fa501
parent6ec161c5b9ababc119c42883de40a23bd8d14bbb
hwdb: reject overlong fnmatch key instead of passing NULL to fnmatch()

When the accumulated trie key exceeds the fixed-size line buffer,
linebuf_get() returns NULL. trie_fnmatch_f() passed that NULL straight
into fnmatch() as the pattern, causing a SIGSEGV on a crafted hwdb.bin
(reachable now that recursion is capped rather than overflowing the
stack first). Treat the NULL like the other corruption checks and
return -EBADMSG.

Follow-up for 73fea38cf1344e08213bb10bfc1e1a98382aee78

Fixes https://github.com/systemd/systemd/issues/42376

Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>
src/libsystemd/sd-hwdb/sd-hwdb.c
test/fuzz/fuzz-hwdb/overlong-fnmatch-key [new file with mode: 0644]