diff mbox series

[5/7] libsepol: reject invalid class datums

Message ID 20231128182334.57740-5-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit 68c3a9991679
Delegated to: Petr Lautrbach
Headers show
Series [1/7] libsepol: validate conditional type rules have a simple default type | expand

Commit Message

Christian Göttsche Nov. 28, 2023, 6:23 p.m. UTC 
Internally class values are stored in multiple placed in a 16-bit wide
integer.  Reject class values exceeding the maximum representable value.
This avoids truncations in the helper
policydb_string_to_security_class(), which gets called before validation
of the policy:

    policydb.c:4082:9: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2113929220 (32-bit, unsigned) to type 'sepol_security_class_t' (aka 'unsigned short') changed the value to 4 (16-bit, unsigned)

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/policydb.c          | 2 ++
 libsepol/src/policydb_validate.c | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index 6ba4f916..f10a8a95 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -2255,6 +2255,8 @@  static int class_read(policydb_t * p, hashtab_t h, struct policy_file *fp)
 
 	len2 = le32_to_cpu(buf[1]);
 	cladatum->s.value = le32_to_cpu(buf[2]);
+	if (cladatum->s.value > UINT16_MAX)
+		goto bad;
 
 	if (symtab_init(&cladatum->permissions, PERM_SYMTAB_SIZE))
 		goto bad;
diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index c2f19fa0..bd8e9f8f 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -389,7 +389,7 @@  static int validate_common_datum_wrapper(__attribute__((unused)) hashtab_key_t k
 
 static int validate_class_datum(sepol_handle_t *handle, const class_datum_t *class, validate_t flavors[])
 {
-	if (validate_value(class->s.value, &flavors[SYM_CLASSES]))
+	if (class->s.value > UINT16_MAX || validate_value(class->s.value, &flavors[SYM_CLASSES]))
 		goto bad;
 	if (class->comdatum && validate_common_datum(handle, class->comdatum, flavors))
 		goto bad;