diff options
| author | Richard Hughes <richard@hughsie.com> | 2013-10-21 16:11:17 +0100 |
|---|---|---|
| committer | Richard Hughes <richard@hughsie.com> | 2013-10-30 10:28:49 +0000 |
| commit | 68133425bfb583136be60c24a1b18bfdb7ea87b7 (patch) | |
| tree | 36a966cb20cf7a91177b0cdbe84935fe964ec249 | |
| parent | 88e528278a4400766f2141e39427a0da99547c55 (diff) | |
| download | colord-68133425bfb583136be60c24a1b18bfdb7ea87b7.tar.gz | |
Restrict the length of key and values when setting metadata
By setting very long keys and/or values over-and-over you can get the colord
daemon to crash with an out-of-memory error.
To prevent this, limit the length of the metadata key to 128 bytes and the
metadata value to 4k. Anything longer than that isn't really metadata...
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1012832
| -rw-r--r-- | src/cd-common.h | 4 | ||||
| -rw-r--r-- | src/cd-device.c | 19 | ||||
| -rw-r--r-- | src/cd-profile.c | 18 |
3 files changed, 41 insertions, 0 deletions
diff --git a/src/cd-common.h b/src/cd-common.h index 108cbe4..adf9343 100644 --- a/src/cd-common.h +++ b/src/cd-common.h @@ -34,6 +34,10 @@ #define COLORD_DBUS_INTERFACE_PROFILE "org.freedesktop.ColorManager.Profile" #define COLORD_DBUS_INTERFACE_SENSOR "org.freedesktop.ColorManager.Sensor" +#define CD_DBUS_METADATA_KEY_LEN_MAX 256 /* chars */ +#define CD_DBUS_METADATA_VALUE_LEN_MAX 4096 /* chars */ + + #define CD_CLIENT_ERROR cd_client_error_quark() GQuark cd_client_error_quark (void); diff --git a/src/cd-device.c b/src/cd-device.c index 43dfa14..0995c26 100644 --- a/src/cd-device.c +++ b/src/cd-device.c @@ -927,6 +927,24 @@ cd_device_set_property_internal (CdDevice *device, gboolean is_metadata = FALSE; CdDevicePrivate *priv = device->priv; + /* sanity check the length of the key and value */ + if (strlen (property) > CD_DBUS_METADATA_KEY_LEN_MAX) { + ret = FALSE; + g_set_error_literal (error, + CD_CLIENT_ERROR, + CD_CLIENT_ERROR_INPUT_INVALID, + "metadata key length invalid"); + goto out; + } + if (value != NULL && strlen (value) > CD_DBUS_METADATA_VALUE_LEN_MAX) { + ret = FALSE; + g_set_error_literal (error, + CD_CLIENT_ERROR, + CD_CLIENT_ERROR_INPUT_INVALID, + "metadata value length invalid"); + goto out; + } + g_debug ("CdDevice: Attempting to set %s to %s on %s", property, value, device->priv->id); if (g_strcmp0 (property, CD_DEVICE_PROPERTY_MODEL) == 0) { @@ -977,6 +995,7 @@ cd_device_set_property_internal (CdDevice *device, property, cd_device_get_nullable_for_string (value)); } +out: return ret; } diff --git a/src/cd-profile.c b/src/cd-profile.c index ebcbc55..83c7c4d 100644 --- a/src/cd-profile.c +++ b/src/cd-profile.c @@ -539,6 +539,24 @@ cd_profile_set_property_internal (CdProfile *profile, gboolean ret = TRUE; CdProfilePrivate *priv = profile->priv; + /* sanity check the length of the key and value */ + if (strlen (property) > CD_DBUS_METADATA_KEY_LEN_MAX) { + ret = FALSE; + g_set_error_literal (error, + CD_CLIENT_ERROR, + CD_CLIENT_ERROR_INPUT_INVALID, + "metadata key length invalid"); + goto out; + } + if (value != NULL && strlen (value) > CD_DBUS_METADATA_VALUE_LEN_MAX) { + ret = FALSE; + g_set_error_literal (error, + CD_CLIENT_ERROR, + CD_CLIENT_ERROR_INPUT_INVALID, + "metadata value length invalid"); + goto out; + } + if (g_strcmp0 (property, CD_PROFILE_PROPERTY_FILENAME) == 0) { ret = cd_profile_set_filename (profile, value, |