> -----Original Message----- > From: Paul Moore [mailto:paul@xxxxxxxxxxxxxx] > Sent: Monday, August 29, 2016 4:21 PM > To: Roberts, William C <william.c.roberts@xxxxxxxxx> > Cc: selinux@xxxxxxxxxxxxx; seandroid-list@xxxxxxxxxxxxx; Stephen Smalley > <sds@xxxxxxxxxxxxx> > Subject: Re: [PATCH 1/3] selinux: detect invalid ebitmap > > On Tue, Aug 23, 2016 at 4:49 PM, <william.c.roberts@xxxxxxxxx> wrote: > > From: William Roberts <william.c.roberts@xxxxxxxxx> > > > > When count is 0 and the highbit is not zero, the ebitmap is not valid > > and the internal node is not allocated. This causes issues when > > routines, like mls_context_isvalid() attempt to use the > > ebitmap_for_each_bit() and ebitmap_node_get_bit() as they assume a > > highbit > 0 will have a node allocated. > > --- > > security/selinux/ss/ebitmap.c | 3 +++ > > 1 file changed, 3 insertions(+) > > Hi William, > > This patch looks good to me, but do I have your permission to add your sign-off? Yes, I guess I missed it. Just so it's easy for you to copy paste: Signed-off-by: William Roberts <william.c.roberts@xxxxxxxxx> > > > diff --git a/security/selinux/ss/ebitmap.c > > b/security/selinux/ss/ebitmap.c index 894b6cd..7d10e5d 100644 > > --- a/security/selinux/ss/ebitmap.c > > +++ b/security/selinux/ss/ebitmap.c > > @@ -374,6 +374,9 @@ int ebitmap_read(struct ebitmap *e, void *fp) > > goto ok; > > } > > > > + if (e->highbit && !count) > > + goto bad; > > + > > for (i = 0; i < count; i++) { > > rc = next_entry(&startbit, fp, sizeof(u32)); > > if (rc < 0) { > > -- > > 1.9.1 > > > > _______________________________________________ > > Selinux mailing list > > Selinux@xxxxxxxxxxxxx > > To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. > > To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx. > > > > -- > paul moore > www.paul-moore.com _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
