From cae65d9a10623bb9063a2e3ca5357bb1602d55af Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Fri, 12 May 2023 11:30:01 +0200 Subject: [PATCH] libsepol: expand: skip invalid cat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bail out on expanding levels with invalid low category. UBSAN report: expand.c:952:21: runtime error: unsigned integer overflow: 0 - 1 cannot be represented in type 'uint32_t' (aka 'unsigned int') Signed-off-by: Christian Göttsche Acked-by: James Carter Reference: https://github.com/SELinuxProject/selinux/commit/cae65d9a10623bb9063a2e3ca5357bb1602d55af Conflict: NA --- libsepol/src/expand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c index c08d3a35..8795229a 100644 --- a/libsepol/src/expand.c +++ b/libsepol/src/expand.c @@ -943,7 +943,7 @@ int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l, return -1; } for (cat = sl->cat; cat; cat = cat->next) { - if (cat->low > cat->high) { + if (!cat->low || cat->low > cat->high) { ERR(h, "Category range is not valid %s.%s", p->p_cat_val_to_name[cat->low - 1], p->p_cat_val_to_name[cat->high - 1]); -- 2.33.0