eba0ffee01
This is based on a patch by Nicolas Iooss. He writes: When secilc compiles the following policy: (block b1 (optional o1 (blockinherit b1) (blockinherit x) ) ) it disables the optional block at pass 3 (CIL_PASS_BLKIN_LINK) because the block "x" does not exist. __cil_resolve_ast_last_child_helper() calls cil_tree_children_destroy() on the optional block, which destroys the two blockinherit statements. But the (blockinherit b1) node was referenced inside (block b1) node, in its block->bi_nodes list. Therefore, when this list is used at pass 4 (CIL_PASS_BLKIN_COPY), it contains a node which was freed: this triggers a use-after-free issue Fix this issue by removing blockinherit nodes from their lists of nodes block->bi_nodes when they are being destroyed. As cil_destroy_blockinherit() does not have a reference to the node containing the blockinherit data, implement this new logic in cil_tree_node_destroy(). This issue was found while investigating a testcase from an OSS-Fuzz issue which seems unrelated (a Null-dereference READ in cil_symtab_get_datum, https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29861). Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: James Carter <jwcart2@gmail.com> Acked-by: Nicolas Iooss <nicolas.iooss@m4x.org> |
||
---|---|---|
.. | ||
include/cil | ||
src | ||
test | ||
.gitignore |