From patchwork Tue Oct 18 18:58:42 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: James Carter X-Patchwork-Id: 9382799 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0F25E600CA for ; Tue, 18 Oct 2016 18:59:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F2A2A29690 for ; Tue, 18 Oct 2016 18:59:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E7ACF29708; Tue, 18 Oct 2016 18:59:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from emsm-gh1-uea11.nsa.gov (smtp.nsa.gov [8.44.101.9]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6888129690 for ; Tue, 18 Oct 2016 18:59:10 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.31,362,1473120000"; d="scan'208";a="16854" IronPort-PHdr: =?us-ascii?q?9a23=3AuIN63xLU0SRnE9auPNmcpTZWNBhigK39O0sv0rFi?= =?us-ascii?q?tYgUL/7xwZ3uMQTl6Ol3ixeRBMOAuqgC1rad6vq8EUU7or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6anHS+4HYoFwnlMkIt?= =?us-ascii?q?f6KuS9SU0pj8jrrus7ToICxwzAKnZr1zKBjk5S7wjeIxxbVYF6Aq1xHSqWFJce?= =?us-ascii?q?kFjUlhJFaUggqurpzopM0rzj5U884F24YAFP+iPvdwcbsNFzkiMmYo9OX3pBLD?= =?us-ascii?q?Sk2J/XJaXWIIwTRSBA2Qzhj/U4y5mSLgqudnkH2YIsb/V6xucSiz5KdsDhnzgW?= =?us-ascii?q?EIMCBvozKfsdB5kK8O+EHpnBd42YOBJdvNOQ=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FEBQDibwZY/wHyM5BcHAEBBAEBCgEBGAEFAQsBgxEBAQE?= =?us-ascii?q?BAR2BRA+6bSiICkwBAQEBAQEBAQIBAl8ngjIEAxMFghECBAECJBMUIA4DCQEBF?= =?us-ascii?q?ykICAMBLRURDgsFGASIMcN3jysRAWiFEwWBIQGHFIdGigoCiS6GWAKKAIV1kHt?= =?us-ascii?q?URoUfVoV5eIEoAQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP; 18 Oct 2016 18:59:09 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u9IIx8Wm022364; Tue, 18 Oct 2016 14:59:08 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u9IIvVOg189944 for ; Tue, 18 Oct 2016 14:57:31 -0400 Received: from moss-lions.infosec.tycho.ncsc.mil (moss-lions [192.168.25.4]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u9IIvVjZ022041 for ; Tue, 18 Oct 2016 14:57:31 -0400 From: James Carter To: selinux@tycho.nsa.gov Subject: [PATCH 1/7] libsepol/cil: Check for improper category range Date: Tue, 18 Oct 2016 14:58:42 -0400 Message-Id: <1476817128-16108-2-git-send-email-jwcart2@tycho.nsa.gov> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1476817128-16108-1-git-send-email-jwcart2@tycho.nsa.gov> References: <1476817128-16108-1-git-send-email-jwcart2@tycho.nsa.gov> X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Nicolas Looss found while fuzzing secilc with AFL that the following policy will cause a segfault. (category c0) (category c1) (categoryorder (c0 c1)) (sensitivity s0) (sensitivitycategory s0 (range c1 c0)) The category range "(range c1 c0)" is invalid because c1 comes after c0 in order. The invalid range is evaluated as containing no categories. There is a check for the resulting empty list and the category datum expression is set to NULL. The segfault occurs because the datum expression is assumed to be non-NULL after evaluation. Add a check for an invalid range when evaluating category ranges. Signed-off-by: James Carter --- libsepol/cil/src/cil_post.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c index f8447c9..caf3321 100644 --- a/libsepol/cil/src/cil_post.c +++ b/libsepol/cil/src/cil_post.c @@ -952,6 +952,11 @@ static int __cil_cat_expr_range_to_bitmap_helper(struct cil_list_item *i1, struc c2 = alias->actual; } + if (c1->value > c2->value) { + cil_log(CIL_ERR, "Invalid category range\n"); + goto exit; + } + for (i = c1->value; i <= c2->value; i++) { if (ebitmap_set_bit(bitmap, i, 1)) { cil_log(CIL_ERR, "Failed to set cat bit\n");