]> git.ipfire.org Git - thirdparty/systemd.git/commit
sd-bus: add depth limit to message_skip_fields() to prevent stack overflow (#42164)
authorYu Watanabe <watanabe.yu+github@gmail.com>
Wed, 20 May 2026 01:22:32 +0000 (10:22 +0900)
committerGitHub <noreply@github.com>
Wed, 20 May 2026 01:22:32 +0000 (10:22 +0900)
commitce260a112fab27abd66d5016540b45d37d322a91
tree35d869005a48ce6b822c07304d8389cc92e9ed04
parent1dbd7cdc06ae8f32d6223db8a9fbb07138dbb3fc
parentddb221c3b26d561286518da99d477e2f580076b0
sd-bus: add depth limit to message_skip_fields() to prevent stack overflow (#42164)

`message_skip_fields()` recursively processes D-Bus variant types in
message header fields with no depth limit. A crafted message with deeply
nested variants can cause unbounded recursion and overflow the stack.

Add a `depth` parameter checked against `BUS_CONTAINER_DEPTH` (128),
matching the limit already enforced by the public
`sd_bus_message_skip()` API. All recursive call sites pass `depth + 1`,
and the top-level caller in `message_parse_fields()` passes `0`.
src/libsystemd/sd-bus/test-bus-marshal.c