On Fri, Jul 2, 2021 at 7:15 AM Nicolas Iooss <nicolas.iooss@xxxxxxx> wrote: > > When __cil_verify_map_class() verifies a classpermission, it calls > __verify_map_perm_classperms() on each item. If the first item reports a > failure and the next one succeeds, the failure is overwritten in > map_args->rc. This is a bug which causes a NULL pointer dereference in > the CIL compiler when compiling the following policy: > > (sid SID) > (sidorder (SID)) > > (class CLASS (PERM1)) > (classorder (CLASS)) > > (classpermission CLSPERM) > (classpermissionset CLSPERM (CLASS (PERM1))) > (classmap files (CLAMAPxx x)) > (classmapping files CLAMAPxx CLSPERM) > > Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30286 > > Signed-off-by: Nicolas Iooss <nicolas.iooss@xxxxxxx> Acked-by: James Carter <jwcart2@xxxxxxxxx> > --- > libsepol/cil/src/cil_verify.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/libsepol/cil/src/cil_verify.c b/libsepol/cil/src/cil_verify.c > index 59397f70f2ea..8ad3dc9e114a 100644 > --- a/libsepol/cil/src/cil_verify.c > +++ b/libsepol/cil/src/cil_verify.c > @@ -1786,8 +1786,12 @@ static int __verify_map_perm_classperms(__attribute__((unused)) hashtab_key_t k, > { > struct cil_verify_map_args *map_args = args; > struct cil_perm *cmp = (struct cil_perm *)d; > + int rc; > > - map_args->rc = __cil_verify_classperms(cmp->classperms, &cmp->datum, &map_args->class->datum, &cmp->datum, CIL_MAP_PERM, 0, 2); > + rc = __cil_verify_classperms(cmp->classperms, &cmp->datum, &map_args->class->datum, &cmp->datum, CIL_MAP_PERM, 0, 2); > + if (rc != SEPOL_OK) { > + map_args->rc = rc; > + } > > return SEPOL_OK; > } > -- > 2.32.0 >
