RepoMirrors
/
selinux
mirror of https://github.com/SELinuxProject/selinux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

libsepol: check scope permissions refer to valid class 

Validate that the permission maps in the scope index refer to a valid
class datum.  Otherwise since commit 52e5c306 ("libsepol: move unchanged
data out of loop") this can lead to a NULL dereference in the class
existence check during linking.

Reported-by: oss-fuzz (issue 69655)
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
This commit is contained in:
Christian Göttsche 2024-06-15 15:25:25 +02:00 committed by James Carter
parent 1efc121466
commit 589e2dba72
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libsepol/src/policydb_validate.c
View File

@ -1468,6 +1468,8 @@ bad:
static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *scope_index, validate_t flavors[])
{
uint32_t i;
if (!ebitmap_is_empty(&scope_index->scope[SYM_COMMONS]))
goto bad;
if (validate_ebitmap(&scope_index->p_classes_scope, &flavors[SYM_CLASSES]))
@ -1484,8 +1486,10 @@ static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *sco
goto bad;
if (validate_ebitmap(&scope_index->p_cat_scope, &flavors[SYM_CATS]))
goto bad;
if (scope_index->class_perms_len > flavors[SYM_CLASSES].nprim)
goto bad;
for (i = 0; i < scope_index->class_perms_len; i++)
if (validate_value(i + 1, &flavors[SYM_CLASSES]))
goto bad;
return 0;