fdo-mirrors/dbus
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/dbus/dbus.git synced 2026-01-26 09:40:26 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
dbus/dbus
History
Simon McVittie 2b7948ef90 userdb: Reference-count DBusUserInfo, DBusGroupInfo 
Previously, the hash table indexed by uid (or gid) took ownership of the
single reference to the heap-allocated struct, and the hash table
indexed by username (or group name) had a borrowed pointer to the same
struct that exists in the other hash table.

However, this can break down if you have two or more distinct usernames
that share a numeric identifier. This is generally a bad idea, because
the user-space model in such situations does not match the kernel-space
reality, and in particular there is no effective kernel-level security
boundary between such users, but it is sometimes done anyway.

In this case, when the second username is looked up in the userdb, it
overwrites (replaces) the entry in the hash table that is indexed by
uid, freeing the DBusUserInfo. This results in both the key and the
value in the hash table that is indexed by username becoming dangling
pointers (use-after-free), leading to undefined behaviour, which is
certainly not what we want to see when doing access control.

An equivalent situation can occur with groups, in the rare case where
a numeric group ID has two names (although I have not heard of this
being done in practice).

Solve this by reference-counting the data structure. There are up to
three references in practice: one held temporarily while the lookup
function is populating and storing it, one held by the hash table that
is indexed by uid, and one held by the hash table that is indexed by
name.

Closes: dbus#305
Signed-off-by: Simon McVittie <smcv@collabora.com>
2020-07-01 13:21:23 +01:00
..
.gitignore .gitignore: Ignore many more generated files 2018-12-14 13:28:50 +00:00
CMakeLists.txt cmake: Add support for systemd integration on Linux operating systems 2020-06-10 18:13:47 +00:00
dbus-address.c tests: Move address test out of libdbus 2019-07-03 11:19:19 +01:00
dbus-address.h Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-arch-deps.h.in Remove support for platforms with no 64-bit integer type 2013-09-16 15:31:02 +01:00
dbus-asv-util.c Add _dbus_asv_add_fixed_array 2019-03-25 21:04:21 +01:00
dbus-asv-util.h Add _dbus_asv_add_fixed_array 2019-03-25 21:04:21 +01:00
dbus-auth.c auth: Clear GUID from server if out of memory 2019-07-02 20:45:31 +01:00
dbus-auth.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-bus.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-bus.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-connection-internal.h Introduce a new macro to export symbols solely for tests 2019-07-03 11:17:27 +01:00
dbus-connection.c _dbus_modify_sigpipe: be thread-safe 2019-12-12 09:36:32 +01:00
dbus-connection.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-credentials.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-credentials.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-dataslot.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-dataslot.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-errors.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-errors.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-file-unix.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-file-win.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-file.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-file.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-hash.c test: Unembed hash test from libdbus and move it into test/ 2019-01-21 15:20:06 +00:00
dbus-hash.h test: Unembed hash test from libdbus and move it into test/ 2019-01-21 15:20:06 +00:00
dbus-init-win.cpp dbus_threads_init_default, dbus_threads_init: be safe to call at any time 2013-05-10 11:35:08 +01:00
dbus-internals.c _dbus_verbose_real: Use the Python convention for quoting potentially multi-line strings when memory is unavailable on Windows 2020-04-27 12:01:30 +00:00
dbus-internals.h In _dbus_verbose_real() avoid possible stack overflows on output to the Windows debug port 2020-02-20 08:50:00 +00:00
dbus-keyring.c embedded tests: Conform to the same API for all tests 2018-12-17 14:12:59 +00:00
dbus-keyring.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-list.c test: Move _dbus_list_test() here 2019-01-21 15:22:07 +00:00
dbus-list.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-macros.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-mainloop.c Rename structure DBusSocketSet to DBusPollableSet and adjust the corresponding functions/files 2019-01-09 15:20:19 +01:00
dbus-mainloop.h Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-marshal-basic.c embedded tests: Conform to the same API for all tests 2018-12-17 14:12:59 +00:00
dbus-marshal-basic.h Don't cast user-supplied pointers to DBusBasicValue * 2018-12-11 12:23:06 +00:00
dbus-marshal-byteswap.c Fix warning: "pointer targets in assignment differ in signedness [-Wpointer-sign]". 2015-11-24 12:26:00 +01:00
dbus-marshal-byteswap.h Add DBUS_PRIVATE_EXPORT decoration to symbols used by dbus-daemon or tests 2015-02-20 20:49:36 +00:00
dbus-marshal-header.c DBusMessage: Add a header field for the container instance 2018-02-16 15:27:37 +00:00
dbus-marshal-header.h _dbus_message_remove_unknown_fields: Add 2018-01-11 18:34:39 +00:00
dbus-marshal-recursive.c Don't cast user-supplied pointers to DBusBasicValue * 2018-12-11 12:23:06 +00:00
dbus-marshal-recursive.h Don't cast user-supplied pointers to DBusBasicValue * 2018-12-11 12:23:06 +00:00
dbus-marshal-validate.c validate_body_helper: Bounds-check before validating booleans 2018-08-02 19:20:32 +01:00
dbus-marshal-validate.h dbus-marshal-validate.h: Make self-contained 2018-12-17 14:12:59 +00:00
dbus-memory.c In _dbus_verbose_real() avoid possible stack overflows on output to the Windows debug port 2020-02-20 08:50:00 +00:00
dbus-memory.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-mempool.c tests: Move mempool test out of libdbus 2019-07-03 11:19:47 +01:00
dbus-mempool.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-message-internal.h Move _dbus_check_fdleaks_* from dbus-message-util to tests 2019-07-02 20:44:33 +01:00
dbus-message-private.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-message-util.c dbus-message-util: Fix Doxygen annotations 2019-07-02 20:44:33 +01:00
dbus-message.c doxygen: fix example for dbus_message_append_args 2019-09-23 13:22:32 +01:00
dbus-message.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-misc.c test: Move _dbus_misc_test() here 2019-01-21 15:22:06 +00:00
dbus-misc.h Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-nonce.c nonce: Don't try to rmdir(NULL) on OOM 2018-08-02 17:15:29 +01:00
dbus-nonce.h DBusNonceFile: Don't rely on caller preallocating the object 2017-11-07 12:43:52 +00:00
dbus-object-tree.c embedded tests: Conform to the same API for all tests 2018-12-17 14:12:59 +00:00
dbus-object-tree.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pending-call-internal.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pending-call.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-pending-call.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pipe-unix.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pipe-win.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pipe.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pipe.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-pollable-set-epoll.c Rename structure DBusSocketSet to DBusPollableSet and adjust the corresponding functions/files 2019-01-09 15:20:19 +01:00
dbus-pollable-set-poll.c Rename structure DBusSocketSet to DBusPollableSet and adjust the corresponding functions/files 2019-01-09 15:20:19 +01:00
dbus-pollable-set.c Rename structure DBusSocketSet to DBusPollableSet and adjust the corresponding functions/files 2019-01-09 15:20:19 +01:00
dbus-pollable-set.h Rename structure DBusSocketSet to DBusPollableSet and adjust the corresponding functions/files 2019-01-09 15:20:19 +01:00
dbus-protocol.h dbus-protocol.h: fix DBUS_ERROR_SPAWN_NO_MEMORY comment 2020-06-10 14:26:03 +04:00
dbus-resources.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-resources.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server-debug-pipe.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-server-debug-pipe.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server-launchd.c _dbus_server_new_for_launchd: Don't leak fd on failure 2017-11-24 12:17:29 +00:00
dbus-server-launchd.h Add launchd implementation. 2010-12-06 21:33:06 +01:00
dbus-server-protected.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server-socket.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-server-socket.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server-unix.c server-unix: Don't leak address of systemd server on success 2018-08-23 18:23:34 +01:00
dbus-server-unix.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server-win.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-server-win.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-server.c test: Move _dbus_server_test() here 2019-01-21 15:22:07 +00:00
dbus-server.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sha.c tests: Move _dbus_sha_test outside libdbus 2019-07-03 11:18:49 +01:00
dbus-sha.h tests: Move _dbus_sha_test outside libdbus 2019-07-03 11:18:49 +01:00
dbus-shared.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-shell.c Add and use _dbus_list_clear_full 2018-08-02 15:26:27 +01:00
dbus-shell.h Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-signature.c test: Move _dbus_signature_test() here 2019-01-21 15:22:06 +00:00
dbus-signature.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sockets-win.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-spawn-unix.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-spawn-win.c dbus-spawn-win.c: Simplify logic of return value from call to _dbus_spawn_program() 2019-01-05 11:41:58 +01:00
dbus-spawn.h dbus-spawn: Don't take ownership of envp 2019-01-05 11:41:58 +01:00
dbus-string-private.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-string-util.c test: Move string tests (most of dbus-string-util.c) here 2019-01-21 15:21:43 +00:00
dbus-string.c DBusString: extend with checking for starting with words 2019-04-26 13:29:42 +02:00
dbus-string.h DBusString: extend with checking for starting with words 2019-04-26 13:29:42 +02:00
dbus-syntax.c Doc: fix incorrect param names, missing params, non-exist params 2013-08-22 20:01:08 +01:00
dbus-syntax.h Add dbus-syntax.[ch] 2012-02-24 12:43:55 +00:00
dbus-sysdeps-pthread.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sysdeps-thread-win.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-sysdeps-unix.c Solaris and derivatives do not adjust cmsg_len on MSG_CTRUNC 2020-06-12 21:18:36 +00:00
dbus-sysdeps-unix.h userdb: Reference-count DBusUserInfo, DBusGroupInfo 2020-07-01 13:21:23 +01:00
dbus-sysdeps-util-unix.c Merge branch 'non-posix-getwpnam-r' into 'master' 2020-03-11 14:15:29 +00:00
dbus-sysdeps-util-win.c bus: Try to raise soft fd limit to match hard limit 2019-04-18 11:54:48 +01:00
dbus-sysdeps-util.c test: Move sysdeps tests here 2019-01-21 15:22:05 +00:00
dbus-sysdeps-win.c Fix return type and usage of WSAWaitForMultipleEvents() 2020-04-29 10:52:23 +00:00
dbus-sysdeps-win.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sysdeps-wince-glue.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sysdeps-wince-glue.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sysdeps.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-sysdeps.h sysdeps: use POSIX poll.h instead of sys/poll.h 2020-03-26 18:17:22 +01:00
dbus-test-tap.c test: Move TAP helpers into dbus-testutils if embedded tests are disabled 2020-04-20 10:13:04 +01:00
dbus-test-tap.h test: Move TAP helpers into dbus-testutils if embedded tests are disabled 2020-04-20 10:13:04 +01:00
dbus-test.h tests: Move userdb test out of libdbus 2019-07-03 11:19:50 +01:00
dbus-threads-internal.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-threads.c various: comment static variables that are locked or otherwise OK 2019-12-12 09:36:24 +01:00
dbus-threads.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-timeout.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-timeout.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport-protected.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport-socket.c Normalize C source files to end with exactly one newline 2020-06-10 10:47:31 +00:00
dbus-transport-socket.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport-unix.c test: Move _dbus_transport_unix_test() here 2019-01-21 15:22:07 +00:00
dbus-transport-unix.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport-win.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport-win.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-transport.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-types.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-userdb-util.c userdb: Reference-count DBusUserInfo, DBusGroupInfo 2020-07-01 13:21:23 +01:00
dbus-userdb.c userdb: Reference-count DBusUserInfo, DBusGroupInfo 2020-07-01 13:21:23 +01:00
dbus-userdb.h userdb: Reference-count DBusUserInfo, DBusGroupInfo 2020-07-01 13:21:23 +01:00
dbus-uuidgen.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-uuidgen.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-valgrind-internal.h Fix building with newer Valgrind 2012-11-09 14:04:27 +00:00
dbus-watch.c trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus-watch.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
dbus.h trivial: Remove trailing whitespace from copyright notices 2018-12-17 11:22:39 +00:00
Makefile.am test: Move TAP helpers into dbus-testutils if embedded tests are disabled 2020-04-20 10:13:04 +01:00
Version.in Link dbus-daemon and dbus-daemon-lauch-helper against libdbus 2015-02-20 20:49:45 +00:00
versioninfo.rc.in Update copyright year in file template for version info on Windows 2020-02-20 08:48:30 +01:00