From 42c4ebcbd4cbd7b27667eb8081ee4dc46f9ece17 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 13 Mar 2014 20:33:22 +0100 Subject: sd-bus: don't look for a 64bit value when we only have 32bit value on reply cookie hash table access This broke hashtable lookups for the message cookies on s390x, which is a 64bit BE machine where accessing 32bit values as 64bit and vice versa will explode. Also, while we are at it, be a bit more careful when dealing with the 64bit cookies we expose and the 32bit serial numbers dbus uses in its payload. Problem identified by Fridrich Strba. --- src/libsystemd/sd-bus/bus-message.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) (limited to 'src/libsystemd/sd-bus/bus-message.c') diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c index fb894eff1f..97ab0e3bea 100644 --- a/src/libsystemd/sd-bus/bus-message.c +++ b/src/libsystemd/sd-bus/bus-message.c @@ -617,7 +617,7 @@ static int message_new_reply( t->header->flags |= BUS_MESSAGE_NO_REPLY_EXPECTED; t->reply_cookie = BUS_MESSAGE_COOKIE(call); - r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, t->reply_cookie); + r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) t->reply_cookie); if (r < 0) goto fail; @@ -752,7 +752,7 @@ int bus_message_new_synthetic_error( t->header->flags |= BUS_MESSAGE_NO_REPLY_EXPECTED; t->reply_cookie = cookie; - r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, t->reply_cookie); + r = message_append_field_uint32(t, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) t->reply_cookie); if (r < 0) goto fail; @@ -5075,21 +5075,26 @@ int bus_message_parse_fields(sd_bus_message *m) { break; } - case BUS_MESSAGE_HEADER_REPLY_SERIAL: + case BUS_MESSAGE_HEADER_REPLY_SERIAL: { + uint32_t serial; + if (m->reply_cookie != 0) return -EBADMSG; if (!streq(signature, "u")) return -EBADMSG; - r = message_peek_field_uint32(m, &ri, item_size, &m->reply_cookie); + r = message_peek_field_uint32(m, &ri, item_size, &serial); if (r < 0) return r; + m->reply_cookie = serial; + if (m->reply_cookie == 0) return -EBADMSG; break; + } case BUS_MESSAGE_HEADER_UNIX_FDS: if (unix_fds != 0) @@ -5489,7 +5494,7 @@ int bus_message_remarshal(sd_bus *bus, sd_bus_message **m) { return -ENOMEM; n->reply_cookie = (*m)->reply_cookie; - r = message_append_field_uint32(n, BUS_MESSAGE_HEADER_REPLY_SERIAL, n->reply_cookie); + r = message_append_field_uint32(n, BUS_MESSAGE_HEADER_REPLY_SERIAL, (uint32_t) n->reply_cookie); if (r < 0) return r; -- cgit v1.2.3-54-g00ecf