• Philip Withnall's avatar
    gvarianttype: Impose a recursion limit of 128 on variant types · 7c4e6e9f
    Philip Withnall authored
    Previously, GVariant has allowed ‘arbitrary’ recursion on GVariantTypes,
    but this isn’t really feasible. We have to deal with GVariants from
    untrusted sources, and the nature of GVariantType means that another
    level of recursion (and hence, for example, another stack frame in your
    application) can be added with a single byte in a variant type signature
    in the input. This gives malicious input sources far too much leverage
    to cause deep stack recursion or massive memory allocations which can
    DoS an application.
    
    Limit recursion to 128 levels (which should be more than enough for
    anyone), document it and add a test. This is, handily, also the limit
    of 64 applied by the D-Bus specification (§(Valid Signatures)), plus a
    bit to allow wrapping of D-Bus messages in additional layers of
    variants.
    
    oss-fuzz#9857
    Signed-off-by: Philip Withnall's avatarPhilip Withnall <withnall@endlessm.com>
    7c4e6e9f
gvarianttypeinfo.h 7.07 KB