sd-bus/bus-message: more prudently verify it's SCM_RIGHTS that got truncated

Follow-up for 6c8de404c98fb9b965cba68360c2db1e3f55b776

As discussed in
https://github.com/systemd/systemd/pull/40089#issuecomment-3672063388,
if any other control msg got truncated it's a genuine error, and
we should reject the message as a whole.

diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index 9d71823b38fee693d56f688e7d24b534670bb384..69975c53711944a850240991dc0eb974c4f61373 100644 (file)
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -4210,15 +4210,19 @@ static int message_parse_fields(sd_bus_message *m, bool got_ctrunc) {
                                        "Received a bus message with too many fds: %" PRIu32 " received vs. %" PRIu32 " declared",
                                        m->n_fds, n_unix_fds_declared);
 
-        if (m->n_fds < n_unix_fds_declared && !got_ctrunc)
-                return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
-                                       "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
-                                       m->n_fds, n_unix_fds_declared);
+        if (m->n_fds < n_unix_fds_declared) {
+                if (!got_ctrunc)
+                        return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
+                                               "Received a bus message with too few fds: %" PRIu32 " received vs. %" PRIu32 " declared",
+                                               m->n_fds, n_unix_fds_declared);
 
-        if (got_ctrunc)
                 log_error("Received a bus message with MSG_CTRUNC set with %" PRIu32 " fds received vs %" PRIu32 " declared",
                           m->n_fds, n_unix_fds_declared);
 
+        } else if (got_ctrunc)
+                return log_error_errno(SYNTHETIC_ERRNO(EBADMSG),
+                                       "Received a bus message with truncated control data, refusing.");
+
         switch (m->header->type) {
 
         case SD_BUS_MESSAGE_SIGNAL: