From 0b507b17a760b21e33fc52ff377db6aa5086c680 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 3 Oct 2012 13:29:20 -0400 Subject: dbus: add some more safety checks before accepting data from bus clients --- src/hostname/hostnamed.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src/hostname') diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c index 8f9d5a04f5..cd3ef491ac 100644 --- a/src/hostname/hostnamed.c +++ b/src/hostname/hostnamed.c @@ -451,6 +451,14 @@ static DBusHandlerResult hostname_message_handler( } else { char *h; + /* The icon name might ultimately be + * used as file name, so better be + * safe than sorry */ + if (k == PROP_ICON_NAME && !filename_is_safe(name)) + return bus_send_error_reply(connection, message, NULL, -EINVAL); + if (k == PROP_PRETTY_HOSTNAME && !string_is_safe(name)) + return bus_send_error_reply(connection, message, NULL, -EINVAL); + h = strdup(name); if (!h) goto oom; -- cgit v1.2.3-54-g00ecf