| Message ID | 20201230201141.3455302-2-nicolas.iooss@m4x.org (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/4] libsepol/cil: remove useless print statement | expand |
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index 255f17ae7e30..0c85eabe5a81 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -556,6 +556,10 @@ int cil_resolve_alias_to_actual(struct cil_tree_node *current, enum cil_flavor f a1_node = a1->datum.nodes->head->data; while (flavor != a1_node->flavor) { + if (a1->actual == NULL) { + cil_tree_log(current, CIL_ERR, "Alias %s references an unused alias %s", alias->datum.name, a1->datum.name); + return SEPOL_ERR; + } a1 = a1->actual; a1_node = a1->datum.nodes->head->data; steps += 1;
OSS-Fuzz found a NULL pointer dereference when the CIL compiler tries to compile a policy where a categoryalias references an unused categoryalias: $ echo '(categoryalias c0)(categoryalias c1)(categoryaliasactual c0 c1)' > tmp.cil $ secil tmp.cil Segmentation fault (core dumped) In such a case, a1 can become NULL in cil_resolve_alias_to_actual(). Add a check to report an error when this occurs. Now the error message is: Alias c0 references an unused alias c1 at tmp.cil:1 Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28471 Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> --- libsepol/cil/src/cil_resolve_ast.c | 4 ++++ 1 file changed, 4 insertions(+)