diff mbox

[v3,6/7] libsepol: bound attr_type_map access by nprim

Message ID 1471276754-25266-7-git-send-email-william.c.roberts@intel.com (mailing list archive)
State Not Applicable
Headers show

Commit Message

Roberts, William C Aug. 15, 2016, 3:59 p.m. UTC 
From: William Roberts <william.c.roberts@intel.com>

Correct an invalid memory access when attr_type_map array
indexing is outside of bounds.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
---
 libsepol/src/policydb.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox

Patch

diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index 604e022..9f1c507 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -3972,6 +3972,10 @@  int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
 					if (!ebitmap_node_get_bit(tnode, j)
 					    || i == j)
 						continue;
+
+					if (j >= p->p_types.nprim)
+						goto bad;
+
 					if (ebitmap_set_bit
 					    (&p->attr_type_map[j], i, 1))
 						goto bad;