CVE 2010-4352: Reject deeply nested variants
authorColin Walters <walters@verbum.org>
Tue, 21 Dec 2010 14:09:29 +0000 (09:09 -0500)
committerColin Walters <walters@verbum.org>
Tue, 21 Dec 2010 14:09:29 +0000 (09:09 -0500)
commit5042c1e5e6df31700215c9dc0618634911b0c9f5
tree572b0f307dc570e9f1396fab84479d3d985a1067
parent9da36ed3b025370b544cce76e8797b4b5984c23e
CVE 2010-4352: Reject deeply nested variants

Add DBUS_INVALID_NESTED_TOO_DEEPLY validity problem and a test that
should generate it.

Previously, we rejected deep nesting in the signature, but
variants allow dynamic message nesting, conditional only
on the depth of the message body.

The nesting limit is 64, which was also the limit in static
signatures.  Empirically, dynamic nesting depth observed on my
Fedora 14 system doesn't exceed 2; 64 is really a huge limit.

https://bugs.freedesktop.org/show_bug.cgi?id=32321

Signed-Off-By: Colin Walters <walters@verbum.org>
Signed-off-by: Will Thompson <will.thompson@collabora.co.uk>
Conflicts:

dbus/dbus-marshal-validate.h
dbus/dbus-marshal-validate.c
dbus/dbus-marshal-validate.h
dbus/dbus-message-factory.c
doc/dbus-specification.xml