Bug 107332

Created attachment 140779 [details] [review]
validate_body_helper: Bounds-check before validating booleans

Running the "embedded tests" through valgrind revealed that without the
attached patch, we would have been willing to read up to 3 bytes off the
end of a message if the message is truncated part way through a boolean. Any
practical allocator will round up allocations to the next 32-bit (or
larger) boundary, so in practice this will not leave the memory buffer
(and in particular did not crash during unit testing), but it could read
uninitialized contents.

On little-endian CPUs, an attacker might be able to use this to learn
whether up to 3 bytes of uninitialized memory in the dbus-daemon
were all-zero (their crafted message would be relayed) or not (their
connection would be disconnected for sending an invalid message). On
big-endian CPUs, an attacker might be able to use this to learn whether
up to 3 bytes were all-zeroes (relayed to a cooperating peer), 0-2
bytes of all-zeroes followed by 0x01 (relayed to a cooperating peer),
or something else (disconnected).

---

I don't think this is practically exploitable, so I'll probably handle this as an ordinary bug rather than as an embargoed security vulnerability; but I wanted to give other D-Bus maintainers a chance to object and point out ways it could be exploited if they disagree with me, so for now it's private.