On Fri, Jan 21, 2022 at 2:18 PM Christian Göttsche
<cgzones@xxxxxxxxxxxxxx> wrote:
>
> Do not return success if the class name length is saturated (or too big
> in the fuzzer build).
>
> Fixes: c3d52a6a ("libsepol: check for saturated class name length")
>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
Acked-by: James Carter <jwcart2@xxxxxxxxx>
> ---
> libsepol/src/policydb.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
> index 562e044e..fc71463e 100644
> --- a/libsepol/src/policydb.c
> +++ b/libsepol/src/policydb.c
> @@ -3937,7 +3937,9 @@ static int scope_index_read(scope_index_t * scope_index,
> if (rc < 0)
> return -1;
> scope_index->class_perms_len = le32_to_cpu(buf[0]);
> - if (zero_or_saturated(scope_index->class_perms_len)) {
> + if (is_saturated(scope_index->class_perms_len))
> + return -1;
> + if (scope_index->class_perms_len == 0) {
> scope_index->class_perms_map = NULL;
> return 0;
> }
> --
> 2.34.1
>
