| Message ID | 20230512093001.49208-2-cgzones@googlemail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4cf37608b563 |
| Delegated to: | Petr Lautrbach |
| Headers | show |
| Series | [1/5] libsepol: validate some object contexts | expand |
diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c index b79c19b9..605d290a 100644 --- a/libsepol/src/policydb.c +++ b/libsepol/src/policydb.c @@ -3650,10 +3650,10 @@ static int range_read(policydb_t * p, struct policy_file *fp) if (rc < 0) goto err; rt->target_class = le32_to_cpu(buf[0]); - if (!value_isvalid(rt->target_class, p->p_classes.nprim)) - goto err; } else rt->target_class = p->process_class; + if (!value_isvalid(rt->target_class, p->p_classes.nprim)) + goto err; r = calloc(1, sizeof(*r)); if (!r) goto err;
For old style range transition rules the class defaults to process. However the policy might not declare the process class leading to setting a wrong bit later on via: if (ebitmap_set_bit(&rtr->tclasses, rt->target_class - 1, 1)) UBSAN report: policydb.c:3684:56: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'uint32_t' (aka 'unsigned int') Signed-off-by: Christian Göttsche <cgzones@googlemail.com> --- libsepol/src/policydb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)