On Mon, Dec 11, 2023 at 9:55 AM Christian Göttsche <cgzones@xxxxxxxxxxxxxx> wrote: > > Validate no common classes inside scope indices are defined. > > Reported-by: oss-fuzz (issue 64849) > Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx> Acked-by: James Carter <jwcart2@xxxxxxxxx> > --- > This probably also resolves issue 64854, which I could not reproduce > locally. > > Supersedes https://patchwork.kernel.org/project/selinux/patch/20231208151831.48343-1-cgzones@xxxxxxxxxxxxxx/ > --- > libsepol/src/policydb_validate.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c > index bd8e9f8f..d86f885e 100644 > --- a/libsepol/src/policydb_validate.c > +++ b/libsepol/src/policydb_validate.c > @@ -1344,6 +1344,8 @@ bad: > > static int validate_scope_index(sepol_handle_t *handle, const scope_index_t *scope_index, validate_t flavors[]) > { > + if (!ebitmap_is_empty(&scope_index->scope[SYM_COMMONS])) > + goto bad; > if (validate_ebitmap(&scope_index->p_classes_scope, &flavors[SYM_CLASSES])) > goto bad; > if (validate_ebitmap(&scope_index->p_roles_scope, &flavors[SYM_ROLES])) > -- > 2.43.0 > >
