RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-04-17 04:40:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

libselinux: check for truncations

Browse Source 
Check for truncations when building or copying strings involving user
input.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2022-06-07 19:14:09 +02:00 committed by James Carter
parent 7d5a89314b
commit 1eb6229a48
8 changed files with 57 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libselinux/src/canonicalize_context.c
View File

@ -33,7 +33,11 @@ int security_canonicalize_context_raw(const char * con,
ret = -1;
goto out;
}
strncpy(buf, con, size);
if (strlcpy(buf, con, size) >= size) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
ret = write(fd, buf, strlen(buf) + 1);
if (ret < 0)

8
libselinux/src/compute_av.c
View File

@ -40,8 +40,14 @@ int security_compute_av_flags_raw(const char * scon,
}
kclass = unmap_class(tclass);
snprintf(buf, len, "%s %s %hu %x", scon, tcon,
ret = snprintf(buf, len, "%s %s %hu %x", scon, tcon,
kclass, unmap_perm(tclass, requested));
if (ret < 0 || (size_t)ret >= len) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
ret = write(fd, buf, strlen(buf));
if (ret < 0)

7
libselinux/src/compute_create.c
View File

@ -75,8 +75,15 @@ int security_compute_create_name_raw(const char * scon,
ret = -1;
goto out;
}
len = snprintf(buf, size, "%s %s %hu",
scon, tcon, unmap_class(tclass));
if (len < 0 || (size_t)len >= size) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
if (objname &&
object_name_encode(objname, buf + len, size - len) < 0) {
errno = ENAMETOOLONG;

8
libselinux/src/compute_member.c
View File

@ -36,7 +36,13 @@ int security_compute_member_raw(const char * scon,
ret = -1;
goto out;
}
snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
ret = snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
if (ret < 0 || (size_t)ret >= size) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
ret = write(fd, buf, strlen(buf));
if (ret < 0)

8
libselinux/src/compute_relabel.c
View File

@ -36,7 +36,13 @@ int security_compute_relabel_raw(const char * scon,
ret = -1;
goto out;
}
snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
ret = snprintf(buf, size, "%s %s %hu", scon, tcon, unmap_class(tclass));
if (ret < 0 || (size_t)ret >= size) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
ret = write(fd, buf, strlen(buf));
if (ret < 0)

8
libselinux/src/compute_user.c
View File

@ -38,7 +38,13 @@ int security_compute_user_raw(const char * scon,
ret = -1;
goto out;
}
snprintf(buf, size, "%s %s", scon, user);
ret = snprintf(buf, size, "%s %s", scon, user);
if (ret < 0 || (size_t)ret >= size) {
errno = EOVERFLOW;
ret = -1;
goto out2;
}
ret = write(fd, buf, strlen(buf));
if (ret < 0)

11
libselinux/src/selinux_restorecon.c
View File

@ -954,7 +954,16 @@ loop_body:
}
/* fall through */
default:
strcpy(ent_path, ftsent->fts_path);
if (strlcpy(ent_path, ftsent->fts_path, sizeof(ent_path)) >= sizeof(ent_path)) {
selinux_log(SELINUX_ERROR,
"Path name too long on %s.\n",
ftsent->fts_path);
errno = ENAMETOOLONG;
state->error = -1;
state->abort = true;
goto finish;
}
ent_st = *ftsent->fts_statp;
if (state->parallel)
pthread_mutex_unlock(&state->mutex);

8
libselinux/src/setrans_client.c
View File

@ -66,7 +66,13 @@ static int setransd_open(void)
memset(&addr, 0, sizeof(addr));
addr.sun_family = AF_UNIX;
strncpy(addr.sun_path, SETRANS_UNIX_SOCKET, sizeof(addr.sun_path));
if (strlcpy(addr.sun_path, SETRANS_UNIX_SOCKET, sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) {
close(fd);
errno = EOVERFLOW;
return -1;
}
if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
close(fd);
return -1;