dcbb3a6a58
fix heap-use-after-free in __class_reset_perm_values() fix heap-buffer-overflow in cil_print_recursive_blockinherit
50 lines
1.8 KiB
Diff
50 lines
1.8 KiB
Diff
From e2d018423d5910e88947bba3b96d2f301d890c62 Mon Sep 17 00:00:00 2001
|
|
From: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
Date: Wed, 30 Dec 2020 21:11:41 +0100
|
|
Subject: [PATCH] libsepol/cil: propagate failure of cil_fill_list()
|
|
|
|
OSS-Fuzz found a Null-dereference READ in the CIL compiler when trying
|
|
to compile the following policy:
|
|
|
|
(optional o (validatetrans x (eq t3 (a ()))))
|
|
|
|
With some logs, secilc reports:
|
|
|
|
Invalid syntax
|
|
Destroying Parse Tree
|
|
Resolving AST
|
|
Failed to resolve validatetrans statement at fuzz:1
|
|
Disabling optional 'o' at tmp.cil:1
|
|
|
|
So there is an "Invalid syntax" error, but the compilation continues.
|
|
Fix this issue by stopping the compilation when cil_fill_list() reports
|
|
an error:
|
|
|
|
Invalid syntax
|
|
Bad expression tree for constraint
|
|
Bad validatetrans declaration at tmp.cil:1
|
|
|
|
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29061
|
|
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
---
|
|
libsepol/cil/src/cil_build_ast.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
|
|
index d5b9977c0..be10d61b1 100644
|
|
--- a/libsepol/cil/src/cil_build_ast.c
|
|
+++ b/libsepol/cil/src/cil_build_ast.c
|
|
@@ -2713,7 +2713,11 @@ static int __cil_fill_constraint_leaf_expr(struct cil_tree_node *current, enum c
|
|
cil_list_append(*leaf_expr, CIL_STRING, current->next->next->data);
|
|
} else if (r_flavor == CIL_LIST) {
|
|
struct cil_list *sub_list;
|
|
- cil_fill_list(current->next->next->cl_head, leaf_expr_flavor, &sub_list);
|
|
+ rc = cil_fill_list(current->next->next->cl_head, leaf_expr_flavor, &sub_list);
|
|
+ if (rc != SEPOL_OK) {
|
|
+ cil_list_destroy(leaf_expr, CIL_TRUE);
|
|
+ goto exit;
|
|
+ }
|
|
cil_list_append(*leaf_expr, CIL_LIST, sub_list);
|
|
} else {
|
|
cil_list_append(*leaf_expr, CIL_CONS_OPERAND, (void *)r_flavor);
|