diff mbox

[v4,5/7] libsepol: bound attr_type_map access by nprim

Message ID 1471368517-20552-6-git-send-email-william.c.roberts@intel.com (mailing list archive)
State Not Applicable
Headers show

Commit Message

Roberts, William C Aug. 16, 2016, 5:28 p.m. UTC 
From: William Roberts <william.c.roberts@intel.com>

Correct an invalid memory access when attr_type_map array
indexing is outside of bounds.

Signed-off-by: William Roberts <william.c.roberts@intel.com>
---
 libsepol/src/policydb.c | 4 ++++
 1 file changed, 4 insertions(+)
diff mbox

Patch

diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index 971793d..b8f6ca8 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -3926,6 +3926,10 @@  int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
 					if (!ebitmap_node_get_bit(tnode, j)
 					    || i == j)
 						continue;
+
+					if (j >= p->p_types.nprim)
+						goto bad;
+
 					if (ebitmap_set_bit
 					    (&p->attr_type_map[j], i, 1))
 						goto bad;