On Tue, Aug 13, 2024 at 1:32 PM James Carter <jwcart2@xxxxxxxxx> wrote:
>
> On Tue, Jul 23, 2024 at 10:42 AM Vit Mojzis <vmojzis@xxxxxxxxxx> wrote:
> >
> > Make sure sym_index is within the bounds of symtab array before using it
> > to index the array.
> >
> > Fixes:
> > Error: OVERRUN (CWE-119):
> > libsepol-3.6/cil/src/cil_resolve_ast.c:3157: assignment: Assigning: "sym_index" = "CIL_SYM_UNKNOWN".
> > libsepol-3.6/cil/src/cil_resolve_ast.c:3189: overrun-call: Overrunning callee's array of size 19 by passing argument "sym_index" (which evaluates to 20) in call to "cil_resolve_name".
> > \# 3187| switch (curr->flavor) {
> > \# 3188| case CIL_STRING:
> > \# 3189|-> rc = cil_resolve_name(parent, curr->data, sym_index, db, &res_datum);
> > \# 3190| if (rc != SEPOL_OK) {
> > \# 3191| goto exit;
> >
> > Signed-off-by: Vit Mojzis <vmojzis@xxxxxxxxxx>
>
> Acked-by: James Carter <jwcart2@xxxxxxxxx>
>
Merged.
Thanks,
Jim
> > ---
> > libsepol/cil/src/cil_resolve_ast.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
> > index 427a320c..da8863c4 100644
> > --- a/libsepol/cil/src/cil_resolve_ast.c
> > +++ b/libsepol/cil/src/cil_resolve_ast.c
> > @@ -4291,7 +4291,7 @@ int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, en
> > int rc = SEPOL_ERR;
> > struct cil_tree_node *node = NULL;
> >
> > - if (name == NULL) {
> > + if (name == NULL || sym_index >= CIL_SYM_NUM) {
> > cil_log(CIL_ERR, "Invalid call to cil_resolve_name\n");
> > goto exit;
> > }
> > --
> > 2.43.0
> >
> >
