diff options
| author | Colin Walters <walters@verbum.org> | 2010-12-21 09:09:29 -0500 |
|---|---|---|
| committer | Colin Walters <walters@verbum.org> | 2010-12-21 09:09:29 -0500 |
| commit | 5042c1e5e6df31700215c9dc0618634911b0c9f5 (patch) | |
| tree | 572b0f307dc570e9f1396fab84479d3d985a1067 /doc | |
| parent | 9da36ed3b025370b544cce76e8797b4b5984c23e (diff) | |
CVE 2010-4352: Reject deeply nested variants
Add DBUS_INVALID_NESTED_TOO_DEEPLY validity problem and a test that
should generate it.
Previously, we rejected deep nesting in the signature, but
variants allow dynamic message nesting, conditional only
on the depth of the message body.
The nesting limit is 64, which was also the limit in static
signatures. Empirically, dynamic nesting depth observed on my
Fedora 14 system doesn't exceed 2; 64 is really a huge limit.
https://bugs.freedesktop.org/show_bug.cgi?id=32321
Signed-Off-By: Colin Walters <walters@verbum.org>
Signed-off-by: Will Thompson <will.thompson@collabora.co.uk>
Conflicts:
dbus/dbus-marshal-validate.h
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/dbus-specification.xml | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml index b5866e53..77930161 100644 --- a/doc/dbus-specification.xml +++ b/doc/dbus-specification.xml @@ -561,12 +561,14 @@ </row><row> <entry><literal>VARIANT</literal></entry> <entry> - A variant type has a marshaled <literal>SIGNATURE</literal> - followed by a marshaled value with the type - given in the signature. - Unlike a message signature, the variant signature - can contain only a single complete type. - So "i", "ai" or "(ii)" is OK, but "ii" is not. + A variant type has a marshaled + <literal>SIGNATURE</literal> followed by a marshaled + value with the type given in the signature. Unlike + a message signature, the variant signature can + contain only a single complete type. So "i", "ai" + or "(ii)" is OK, but "ii" is not. Use of variants may not + cause a total message depth to be larger than 64, including + other container types such as structures. </entry> <entry> 1 (alignment of the signature) |