core: don't assert when serializing malformed state

evverx · Oct 18, 2023 · 892eb4d · 892eb4d
1 parent 81c4be6
commit 892eb4d
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 16 deletions.
diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c
@@ -1261,22 +1261,24 @@ static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fd
         if (r < 0)
                 return r;
 
-        if (p->n_socket_fds > 0) {
-                r = serialize_item_format(f, "exec-parameters-n-socket-fds", "%zu", p->n_socket_fds);
-                if (r < 0)
-                        return r;
-        }
+        if (p->fds) {
+                if (p->n_socket_fds > 0) {
+                        r = serialize_item_format(f, "exec-parameters-n-socket-fds", "%zu", p->n_socket_fds);
+                        if (r < 0)
+                                return r;
+                }
 
-        if (p->n_storage_fds > 0) {
-                r = serialize_item_format(f, "exec-parameters-n-storage-fds", "%zu", p->n_storage_fds);
-                if (r < 0)
-                        return r;
-        }
+                if (p->n_storage_fds > 0) {
+                        r = serialize_item_format(f, "exec-parameters-n-storage-fds", "%zu", p->n_storage_fds);
+                        if (r < 0)
+                                return r;
+                }
 
-        if (p->n_socket_fds + p->n_storage_fds > 0) {
-                r = serialize_fd_many(f, fds, "exec-parameters-fds", p->fds, p->n_socket_fds + p->n_storage_fds);
-                if (r < 0)
-                        return r;
+                if (p->n_socket_fds + p->n_storage_fds > 0) {
+                        r = serialize_fd_many(f, fds, "exec-parameters-fds", p->fds, p->n_socket_fds + p->n_storage_fds);
+                        if (r < 0)
+                                return r;
+                }
         }
 
         r = serialize_strv(f, "exec-parameters-fd-names", p->fd_names);

diff --git a/src/shared/serialize.c b/src/shared/serialize.c
@@ -207,7 +207,9 @@ int serialize_item_hexmem(FILE *f, const char *key, const void *p, size_t l) {
 
         assert(f);
         assert(key);
-        assert(p || l == 0);
+
+        if (!p && l > 0)
+                return -EINVAL;
 
         if (l == 0)
                 return 0;
@@ -230,7 +232,9 @@ int serialize_item_base64mem(FILE *f, const char *key, const void *p, size_t l)
 
         assert(f);
         assert(key);
-        assert(p || l == 0);
+
+        if (!p && l > 0)
+                return -EINVAL;
 
         if (l == 0)
                 return 0;

diff --git a/test/fuzz/fuzz-execute-serialize/crash-395e b/test/fuzz/fuzz-execute-serialize/crash-395e
@@ -0,0 +1,3 @@
+
+
+exec-parameters-n-storage-fds=1782
diff --git a/test/fuzz/fuzz-execute-serialize/crash-622a b/test/fuzz/fuzz-execute-serialize/crash-622a
@@ -0,0 +1,3 @@
+exec-context-root-hash=0B12
+exec-context-root-hash=0B1e�����exeec-unx-euucmask=10
+exec-context-root-hash=0Be-22