From 52abb5172f7426bb3f1dbe63a2b3a2d2ea7e7ac2 Mon Sep 17 00:00:00 2001
From: Alban Crequy <alban.crequy@collabora.co.uk>
Date: Fri, 18 Jul 2014 16:45:07 +0100
Subject: [PATCH 06/10] DBusConnection: implements
 _dbus_connection_get_pending_fds_count

This is one of four commits needed to address CVE-2014-3637.

This will allow the bus to know whether there are pending file descriptors in a
DBusConnection's DBusMessageLoader.

https://bugs.freedesktop.org/show_bug.cgi?id=80559
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
[fix compilation on platforms that do not HAVE_UNIX_FD_PASSING -smcv]
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
(cherry picked from commit 995734750cea65012537748ee56488c707d2f027)
Conflicts:
	dbus/dbus-message.c
---
 dbus/dbus-connection-internal.h |  1 +
 dbus/dbus-connection.c          | 11 +++++++++++
 dbus/dbus-message-internal.h    |  1 +
 dbus/dbus-message.c             | 15 +++++++++++++++
 dbus/dbus-transport.c           | 11 +++++++++++
 dbus/dbus-transport.h           |  1 +
 6 files changed, 40 insertions(+)

diff --git a/dbus/dbus-connection-internal.h b/dbus/dbus-connection-internal.h
index 3d37f18..f5edf3c 100644
--- a/dbus/dbus-connection-internal.h
+++ b/dbus/dbus-connection-internal.h
@@ -100,6 +100,7 @@ void              _dbus_connection_test_get_locks                 (DBusConnectio
                                                                    DBusMutex **io_path_mutex_loc,
                                                                    DBusCondVar **dispatch_cond_loc,
                                                                    DBusCondVar **io_path_cond_loc);
+int               _dbus_connection_get_pending_fds_count          (DBusConnection *connection);
 
 /* if DBUS_ENABLE_STATS */
 void _dbus_connection_get_stats (DBusConnection *connection,
diff --git a/dbus/dbus-connection.c b/dbus/dbus-connection.c
index b175a44..07a9ebf 100644
--- a/dbus/dbus-connection.c
+++ b/dbus/dbus-connection.c
@@ -2532,6 +2532,17 @@ _dbus_connection_block_pending_call (DBusPendingCall *pending)
   dbus_pending_call_unref (pending);
 }
 
+/**
+ * Return how many file descriptors are pending in the loader
+ *
+ * @param connection the connection
+ */
+int
+_dbus_connection_get_pending_fds_count (DBusConnection *connection)
+{
+  return _dbus_transport_get_pending_fds_count (connection->transport);
+}
+
 /** @} */
 
 /**
diff --git a/dbus/dbus-message-internal.h b/dbus/dbus-message-internal.h
index c194873..de03edd 100644
--- a/dbus/dbus-message-internal.h
+++ b/dbus/dbus-message-internal.h
@@ -97,6 +97,7 @@ long               _dbus_message_loader_get_max_message_size  (DBusMessageLoader
 void               _dbus_message_loader_set_max_message_unix_fds(DBusMessageLoader  *loader,
                                                                  long                n);
 long               _dbus_message_loader_get_max_message_unix_fds(DBusMessageLoader  *loader);
+int                _dbus_message_loader_get_pending_fds_count (DBusMessageLoader  *loader);
 
 typedef struct DBusInitialFDs DBusInitialFDs;
 DBusInitialFDs *_dbus_check_fdleaks_enter (void);
diff --git a/dbus/dbus-message.c b/dbus/dbus-message.c
index b0c641e..5d70f69 100644
--- a/dbus/dbus-message.c
+++ b/dbus/dbus-message.c
@@ -4428,6 +4428,21 @@ static DBusDataSlotAllocator slot_allocator;
 _DBUS_DEFINE_GLOBAL_LOCK (message_slots);
 
 /**
+ * Return how many file descriptors are pending in the loader
+ *
+ * @param loader the loader
+ */
+int
+_dbus_message_loader_get_pending_fds_count (DBusMessageLoader *loader)
+{
+#ifdef HAVE_UNIX_FD_PASSING
+  return loader->n_unix_fds;
+#else
+  return 0;
+#endif
+}
+
+/**
  * Allocates an integer ID to be used for storing application-specific
  * data on any DBusMessage. The allocated ID may then be used
  * with dbus_message_set_data() and dbus_message_get_data().
diff --git a/dbus/dbus-transport.c b/dbus/dbus-transport.c
index 6b58fda..e4d03c1 100644
--- a/dbus/dbus-transport.c
+++ b/dbus/dbus-transport.c
@@ -1491,6 +1491,17 @@ _dbus_transport_set_allow_anonymous (DBusTransport              *transport,
   transport->allow_anonymous = value != FALSE;
 }
 
+/**
+ * Return how many file descriptors are pending in the loader
+ *
+ * @param transport the transport
+ */
+int
+_dbus_transport_get_pending_fds_count (DBusTransport *transport)
+{
+  return _dbus_message_loader_get_pending_fds_count (transport->loader);
+}
+
 #ifdef DBUS_ENABLE_STATS
 void
 _dbus_transport_get_stats (DBusTransport  *transport,
diff --git a/dbus/dbus-transport.h b/dbus/dbus-transport.h
index 4b82151..6a3a8b3 100644
--- a/dbus/dbus-transport.h
+++ b/dbus/dbus-transport.h
@@ -96,6 +96,7 @@ dbus_bool_t        _dbus_transport_set_auth_mechanisms    (DBusTransport
                                                            const char                **mechanisms);
 void               _dbus_transport_set_allow_anonymous    (DBusTransport              *transport,
                                                            dbus_bool_t                 value);
+int                _dbus_transport_get_pending_fds_count  (DBusTransport              *transport);
 
 /* if DBUS_ENABLE_STATS */
 void _dbus_transport_get_stats (DBusTransport  *transport,
-- 
2.1.0