| Message ID | 20220119143926.5464-1-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | libsepol: return failure on saturated class name length | expand |
On Fri, Jan 21, 2022 at 2:18 PM Christian Göttsche <cgzones@googlemail.com> wrote: > > Do not return success if the class name length is saturated (or too big > in the fuzzer build). > > Fixes: c3d52a6a ("libsepol: check for saturated class name length") > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: James Carter <jwcart2@gmail.com> > --- > libsepol/src/policydb.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c > index 562e044e..fc71463e 100644 > --- a/libsepol/src/policydb.c > +++ b/libsepol/src/policydb.c > @@ -3937,7 +3937,9 @@ static int scope_index_read(scope_index_t * scope_index, > if (rc < 0) > return -1; > scope_index->class_perms_len = le32_to_cpu(buf[0]); > - if (zero_or_saturated(scope_index->class_perms_len)) { > + if (is_saturated(scope_index->class_perms_len)) > + return -1; > + if (scope_index->class_perms_len == 0) { > scope_index->class_perms_map = NULL; > return 0; > } > -- > 2.34.1 >
On Tue, Jan 25, 2022 at 9:44 AM James Carter <jwcart2@gmail.com> wrote: > > On Fri, Jan 21, 2022 at 2:18 PM Christian Göttsche > <cgzones@googlemail.com> wrote: > > > > Do not return success if the class name length is saturated (or too big > > in the fuzzer build). > > > > Fixes: c3d52a6a ("libsepol: check for saturated class name length") > > > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com> > > Acked-by: James Carter <jwcart2@gmail.com> > Merged. Thanks, Jim > > --- > > libsepol/src/policydb.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c > > index 562e044e..fc71463e 100644 > > --- a/libsepol/src/policydb.c > > +++ b/libsepol/src/policydb.c > > @@ -3937,7 +3937,9 @@ static int scope_index_read(scope_index_t * scope_index, > > if (rc < 0) > > return -1; > > scope_index->class_perms_len = le32_to_cpu(buf[0]); > > - if (zero_or_saturated(scope_index->class_perms_len)) { > > + if (is_saturated(scope_index->class_perms_len)) > > + return -1; > > + if (scope_index->class_perms_len == 0) { > > scope_index->class_perms_map = NULL; > > return 0; > > } > > -- > > 2.34.1 > >
diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index 562e044e..fc71463e 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -3937,7 +3937,9 @@ static int scope_index_read(scope_index_t * scope_index, if (rc < 0) return -1; scope_index->class_perms_len = le32_to_cpu(buf[0]); - if (zero_or_saturated(scope_index->class_perms_len)) { + if (is_saturated(scope_index->class_perms_len)) + return -1; + if (scope_index->class_perms_len == 0) { scope_index->class_perms_map = NULL; return 0; }
Do not return success if the class name length is saturated (or too big in the fuzzer build). Fixes: c3d52a6a ("libsepol: check for saturated class name length") Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- libsepol/src/policydb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)