From 019f077bbe1554efeec07b1242757892aaf484f0 Mon Sep 17 00:00:00 2001
From: David Rheinsberg <david.rheinsberg@gmail.com>
Date: Thu, 18 Mar 2021 11:33:37 +0100
Subject: [PATCH] dbus-broker: apply fix for incorrect at_console assertion

Apply a fix from upstream for an incorrect at_console range assertion
possibly affecting some of our users.

Signed-off-by: David Rheinsberg <david.rheinsberg@gmail.com>
---
 ...8a7d60e46806e0ef87994d3024245db0d84a.patch | 38 +++++++++++++++++++
 dbus-broker.spec                              |  6 ++-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 1add8a7d60e46806e0ef87994d3024245db0d84a.patch

diff --git a/1add8a7d60e46806e0ef87994d3024245db0d84a.patch b/1add8a7d60e46806e0ef87994d3024245db0d84a.patch
new file mode 100644
index 0000000..76db910
--- /dev/null
+++ b/1add8a7d60e46806e0ef87994d3024245db0d84a.patch
@@ -0,0 +1,38 @@
+From 1add8a7d60e46806e0ef87994d3024245db0d84a Mon Sep 17 00:00:00 2001
+From: David Rheinsberg <david.rheinsberg@gmail.com>
+Date: Thu, 18 Mar 2021 11:10:02 +0100
+Subject: [PATCH] launch/policy: fix incorrect assertion for at_console
+
+We write at_console policies for ranges of uids. If one of those ranges
+is 0, an overflow assertion will incorrectly fire. Fix this and simplify
+the assertions for better readability.
+
+Note that such empty ranges will happen if more than one user on the
+system is considered `at_console` **and** those users have consecutive
+UIDs. Another possibility for empty ranges is when uid 0 is considered
+at_console.
+
+In any case, the assertion will abort the application incorrectly. So
+this is not a security issue, but merely an incorrect assertion.
+
+Signed-off-by: David Rheinsberg <david.rheinsberg@gmail.com>
+---
+ src/launch/policy.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/launch/policy.c b/src/launch/policy.c
+index f91f11b..75eb0d3 100644
+--- a/src/launch/policy.c
++++ b/src/launch/policy.c
+@@ -934,7 +934,10 @@ static int policy_export_xmit(Policy *policy, CList *list1, CList *list2, sd_bus
+ static int policy_export_console(Policy *policy, sd_bus_message *m, PolicyEntries *entries, uint32_t uid_start, uint32_t n_uid) {
+         int r;
+ 
+-        c_assert(((uint32_t)-1) - n_uid + 1 >= uid_start);
++        /* check for overflow */
++        c_assert(uid_start + n_uid >= uid_start);
++        /* check for encoding into dbus `u` type */
++        c_assert(uid_start + n_uid <= (uint32_t)-1);
+ 
+         if (n_uid == 0)
+                 return 0;
diff --git a/dbus-broker.spec b/dbus-broker.spec
index c7ec025..8f7013c 100644
--- a/dbus-broker.spec
+++ b/dbus-broker.spec
@@ -2,11 +2,12 @@
 
 Name:                 dbus-broker
 Version:              28
-Release:              1%{?dist}
+Release:              2%{?dist}
 Summary:              Linux D-Bus Message Broker
 License:              ASL 2.0
 URL:                  https://github.com/bus1/dbus-broker
 Source0:              https://github.com/bus1/dbus-broker/releases/download/v%{version}/dbus-broker-%{version}.tar.xz
+Patch0000:            https://github.com/bus1/dbus-broker/commit/1add8a7d60e46806e0ef87994d3024245db0d84a.patch
 %{?systemd_requires}
 BuildRequires:        pkgconfig(audit)
 BuildRequires:        pkgconfig(expat)
@@ -93,6 +94,9 @@ fi
 %{_userunitdir}/dbus-broker.service
 
 %changelog
+* Thu Mar 18 2021 David Rheinsberg <david.rheinsberg@gmail.com> - 28-2
+- Apply fix for incorrect at_console range assertion.
+
 * Thu Mar 18 2021 David Rheinsberg <david.rheinsberg@gmail.com> - 28-1
 - Update to upstream v28.
 - Drop unused c-util based bundling annotations.