On Sun, 3 Dec 2017, Tetsuo Handa wrote: > Tetsuo Handa wrote: > > which will allow strcmp() to trigger out of bound read when "size" is > > larger than strlen(initial_sid_to_string[i]). > > Oops. "smaller" than. > > > > > Thus, I guess the simplest fix is to use strncmp() instead of strcmp(). > > Can somebody test below patch? (My CentOS 7 environment does not support > enabling SELinux in linux.git . Userspace tool is too old to support?) You mean enabling KASAN? Yep, you need gcc 4.9.2 or better. Recent Fedora has it. -- James Morris <james.l.morris@xxxxxxxxxx>
