[systemd-devel] [PATCH] bus: fix null pointer dereference

[Ronny Chevalier]

CID#1237620
---
 src/libsystemd/sd-bus/bus-message.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/libsystemd/sd-bus/bus-message.c b/src/libsystemd/sd-bus/bus-message.c
index be36d9f..edadacf 100644
--- a/src/libsystemd/sd-bus/bus-message.c
+++ b/src/libsystemd/sd-bus/bus-message.c
@@ -2048,6 +2048,7 @@ static int bus_message_close_variant(sd_bus_message *m, struct bus_container *c)
 
         assert(m);
         assert(c);
+        assert(c->signature);
 
         if (!BUS_MESSAGE_IS_GVARIANT(m))
                 return 0;
@@ -2174,6 +2175,8 @@ _public_ int sd_bus_message_close_container(sd_bus_message *m) {
         if (c->enclosing != SD_BUS_TYPE_ARRAY)
                 if (c->signature && c->signature[c->index] != 0)
                         return -EINVAL;
+        if (!c->signature && c->enclosing == SD_BUS_TYPE_VARIANT)
+                return -EINVAL;
 
         m->n_containers--;
 
-- 
2.1.3