RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2025-03-31 16:26:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsepol/cil: fix double-free in cil categories parser

Browse Source 
When cil_fill_cats() fails to parse an expression and destroys a
category set, it fails to reset *cats to NULL. This makes this object be
destroyed again in cil_destroy_catset().

This bug can be triggered by the following policy:

    (class CLASS (PERM))
    (classorder (CLASS))
    (sid SID)
    (sidorder (SID))
    (user USER)
    (role ROLE)
    (type TYPE)
    (category CAT)
    (categoryorder (CAT))
    (sensitivity SENS)
    (sensitivityorder (SENS))
    (sensitivitycategory SENS (CAT))
    (allow TYPE self (CLASS (PERM)))
    (roletype ROLE TYPE)
    (userrole USER ROLE)
    (userlevel USER (SENS))
    (userrange USER ((SENS)(SENS (CAT))))
    (sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))

    (categoryset cats (range unknown))

This bug has been found by fuzzing secilc with american fuzzy lop.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2016-10-03 22:46:56 +02:00 committed by James Carter
parent f1ba58a199
commit 81c9ca5f96
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libsepol/cil/src/cil_build_ast.c
View File

@ -5481,6 +5481,7 @@ int cil_fill_cats(struct cil_tree_node *curr, struct cil_cats **cats)
rc = cil_gen_expr(curr, CIL_CAT, &(*cats)->str_expr);
if (rc != SEPOL_OK) {
cil_destroy_cats(*cats);
*cats = NULL;
}
return rc;