From 228c06d97a8a33b60b89ded17acbd0e92cca9cfe Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Wed, 30 Dec 2020 11:07:45 +0100 Subject: [PATCH] libsepol/cil: fix out-of-bound read in cil_print_recursive_blockinherit OSS-Fuzz found a heap buffer overflow (out-of-bound reads) when the CIL compiler tries to report a recursive blockinherit with an optional block: $ echo '(block b (optional o (blockinherit b)))' > tmp.cil $ secilc tmp.cil Segmentation fault (core dumped) This is because cil_print_recursive_blockinherit() assumes that all nodes are either CIL_BLOCK or CIL_BLOCKINHERIT. Add support for other block kinds, using cil_node_to_string() to show them. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28462 Signed-off-by: Nicolas Iooss --- libsepol/cil/src/cil_resolve_ast.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c index affa7657b..68b590bcc 100644 --- a/libsepol/cil/src/cil_resolve_ast.c +++ b/libsepol/cil/src/cil_resolve_ast.c @@ -2347,11 +2347,13 @@ void cil_print_recursive_blockinherit(struct cil_tree_node *bi_node, struct cil_ for (curr = bi_node; curr != terminating_node; curr = curr->parent) { if (curr->flavor == CIL_BLOCK) { cil_list_prepend(trace, CIL_NODE, curr); - } else { + } else if (curr->flavor == CIL_BLOCKINHERIT) { if (curr != bi_node) { cil_list_prepend(trace, CIL_NODE, NODE(((struct cil_blockinherit *)curr->data)->block)); } cil_list_prepend(trace, CIL_NODE, curr); + } else { + cil_list_prepend(trace, CIL_NODE, curr); } } cil_list_prepend(trace, CIL_NODE, terminating_node); @@ -2360,8 +2362,12 @@ void cil_print_recursive_blockinherit(struct cil_tree_node *bi_node, struct cil_ curr = item->data; if (curr->flavor == CIL_BLOCK) { cil_tree_log(curr, CIL_ERR, "block %s", DATUM(curr->data)->name); - } else { + } else if (curr->flavor == CIL_BLOCKINHERIT) { cil_tree_log(curr, CIL_ERR, "blockinherit %s", ((struct cil_blockinherit *)curr->data)->block_str); + } else if (curr->flavor == CIL_OPTIONAL) { + cil_tree_log(curr, CIL_ERR, "optional %s", DATUM(curr->data)->name); + } else { + cil_tree_log(curr, CIL_ERR, "%s", cil_node_to_string(curr)); } }