Do not return success if the class name length is saturated (or too big
in the fuzzer build).
Fixes: c3d52a6a ("libsepol: check for saturated class name length")
Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
---
libsepol/src/policydb.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index 562e044e..fc71463e 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -3937,7 +3937,9 @@ static int scope_index_read(scope_index_t * scope_index,
if (rc < 0)
return -1;
scope_index->class_perms_len = le32_to_cpu(buf[0]);
- if (zero_or_saturated(scope_index->class_perms_len)) {
+ if (is_saturated(scope_index->class_perms_len))
+ return -1;
+ if (scope_index->class_perms_len == 0) {
scope_index->class_perms_map = NULL;
return 0;
}
--
2.34.1
