From 68c3a9991679702a7adc6e040e5703a7abb50b16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Tue, 28 Nov 2023 19:23:32 +0100 Subject: [PATCH] libsepol: reject invalid class datums MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Internally class values are stored in multiple placed in a 16-bit wide integer. Reject class values exceeding the maximum representable value. This avoids truncations in the helper policydb_string_to_security_class(), which gets called before validation of the policy: policydb.c:4082:9: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2113929220 (32-bit, unsigned) to type 'sepol_security_class_t' (aka 'unsigned short') changed the value to 4 (16-bit, unsigned) Signed-off-by: Christian Göttsche Acked-by: James Carter --- libsepol/src/policydb.c | 2 ++ libsepol/src/policydb_validate.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index 6ba4f916..f10a8a95 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -2255,6 +2255,8 @@ static int class_read(policydb_t * p, hashtab_t h, struct policy_file *fp) len2 = le32_to_cpu(buf[1]); cladatum->s.value = le32_to_cpu(buf[2]); + if (cladatum->s.value > UINT16_MAX) + goto bad; if (symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE)) goto bad; diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c index c2f19fa0..bd8e9f8f 100644 --- a/libsepol/src/policydb_validate.c +++ b/libsepol/src/policydb_validate.c @@ -389,7 +389,7 @@ static int validate_common_datum_wrapper(__attribute__((unused)) hashtab_key_t k static int validate_class_datum(sepol_handle_t *handle, const class_datum_t *class, validate_t flavors[]) { - if (validate_value(class->s.value, &flavors[SYM_CLASSES])) + if (class->s.value > UINT16_MAX || validate_value(class->s.value, &flavors[SYM_CLASSES])) goto bad; if (class->comdatum && validate_common_datum(handle, class->comdatum, flavors)) goto bad;