From c3d52a6a306ee5a99dd4524305176df9cdcbf30e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Thu, 6 Jan 2022 21:43:36 +0100 Subject: [PATCH] libsepol: check for saturated class name length MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Check the from the polciy read length value to guard allocations. In the fuzzer build the value will also be bounded to avoid oom reports. ==143646==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0xd60000000 bytes #0 0x4dac18 in __interceptor_calloc (./out/binpolicy-fuzzer+0x4dac18) #1 0x55d388 in scope_index_read ./libsepol/src/policydb.c:3945:7 #2 0x550097 in avrule_decl_read ./libsepol/src/policydb.c:3984:6 #3 0x550097 in avrule_block_read ./libsepol/src/policydb.c:4044:8 #4 0x54b3ac in policydb_read ./libsepol/src/policydb.c:4456:7 #5 0x518fd9 in LLVMFuzzerTestOneInput ./libsepol/fuzz/binpolicy-fuzzer.c:35:6 #6 0x43f623 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (./out/binpolicy-fuzzer+0x43f623) #7 0x42910f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (./out/binpolicy-fuzzer+0x42910f) #8 0x42ee76 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (./out/binpolicy-fuzzer+0x42ee76) #9 0x458ff2 in main (./out/binpolicy-fuzzer+0x458ff2) #10 0x7fd37b7931c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 Found by oss-fuzz (#42909) Signed-off-by: Christian Göttsche --- libsepol/src/policydb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index 79aba3af..562e044e 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -3937,7 +3937,7 @@ static int scope_index_read(scope_index_t * scope_index, if (rc < 0) return -1; scope_index->class_perms_len = le32_to_cpu(buf[0]); - if (scope_index->class_perms_len == 0) { + if (zero_or_saturated(scope_index->class_perms_len)) { scope_index->class_perms_map = NULL; return 0; }