dcbb3a6a58
fix heap-use-after-free in __class_reset_perm_values() fix heap-buffer-overflow in cil_print_recursive_blockinherit
58 lines
2.3 KiB
Diff
58 lines
2.3 KiB
Diff
From 228c06d97a8a33b60b89ded17acbd0e92cca9cfe Mon Sep 17 00:00:00 2001
|
|
From: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
Date: Wed, 30 Dec 2020 11:07:45 +0100
|
|
Subject: [PATCH] libsepol/cil: fix out-of-bound read in
|
|
cil_print_recursive_blockinherit
|
|
|
|
OSS-Fuzz found a heap buffer overflow (out-of-bound reads) when the CIL
|
|
compiler tries to report a recursive blockinherit with an optional
|
|
block:
|
|
|
|
$ echo '(block b (optional o (blockinherit b)))' > tmp.cil
|
|
$ secilc tmp.cil
|
|
Segmentation fault (core dumped)
|
|
|
|
This is because cil_print_recursive_blockinherit() assumes that all
|
|
nodes are either CIL_BLOCK or CIL_BLOCKINHERIT. Add support for other
|
|
block kinds, using cil_node_to_string() to show them.
|
|
|
|
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28462
|
|
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
---
|
|
libsepol/cil/src/cil_resolve_ast.c | 10 ++++++++--
|
|
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
index affa7657b..68b590bcc 100644
|
|
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
@@ -2347,11 +2347,13 @@ void cil_print_recursive_blockinherit(struct cil_tree_node *bi_node, struct cil_
|
|
for (curr = bi_node; curr != terminating_node; curr = curr->parent) {
|
|
if (curr->flavor == CIL_BLOCK) {
|
|
cil_list_prepend(trace, CIL_NODE, curr);
|
|
- } else {
|
|
+ } else if (curr->flavor == CIL_BLOCKINHERIT) {
|
|
if (curr != bi_node) {
|
|
cil_list_prepend(trace, CIL_NODE, NODE(((struct cil_blockinherit *)curr->data)->block));
|
|
}
|
|
cil_list_prepend(trace, CIL_NODE, curr);
|
|
+ } else {
|
|
+ cil_list_prepend(trace, CIL_NODE, curr);
|
|
}
|
|
}
|
|
cil_list_prepend(trace, CIL_NODE, terminating_node);
|
|
@@ -2360,8 +2362,12 @@ void cil_print_recursive_blockinherit(struct cil_tree_node *bi_node, struct cil_
|
|
curr = item->data;
|
|
if (curr->flavor == CIL_BLOCK) {
|
|
cil_tree_log(curr, CIL_ERR, "block %s", DATUM(curr->data)->name);
|
|
- } else {
|
|
+ } else if (curr->flavor == CIL_BLOCKINHERIT) {
|
|
cil_tree_log(curr, CIL_ERR, "blockinherit %s", ((struct cil_blockinherit *)curr->data)->block_str);
|
|
+ } else if (curr->flavor == CIL_OPTIONAL) {
|
|
+ cil_tree_log(curr, CIL_ERR, "optional %s", DATUM(curr->data)->name);
|
|
+ } else {
|
|
+ cil_tree_log(curr, CIL_ERR, "%s", cil_node_to_string(curr));
|
|
}
|
|
}
|
|
|