dcbb3a6a58
fix heap-use-after-free in __class_reset_perm_values() fix heap-buffer-overflow in cil_print_recursive_blockinherit
40 lines
1.6 KiB
Diff
40 lines
1.6 KiB
Diff
From 6c8fca10452e445edf52daffc69f2e9dfcdac54c Mon Sep 17 00:00:00 2001
|
|
From: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
Date: Wed, 30 Dec 2020 21:11:40 +0100
|
|
Subject: [PATCH] libsepol/cil: do not add a stack variable to a list
|
|
|
|
OSS-Fuzz found a heap use-after-free when the CIL compiler destroys its
|
|
database after failing to compile the following policy:
|
|
|
|
(validatetrans x (eq t3 (a)))
|
|
|
|
This is caused by the fact that the validatetrans AST object references
|
|
a stack variable local to __cil_fill_constraint_leaf_expr, when parsing
|
|
the list "(a)":
|
|
|
|
struct cil_list *sub_list;
|
|
cil_fill_list(current->next->next->cl_head, leaf_expr_flavor, &sub_list);
|
|
cil_list_append(*leaf_expr, CIL_LIST, &sub_list);
|
|
|
|
Drop the & sign to really add the list like it is supposed to be.
|
|
|
|
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28507
|
|
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
---
|
|
libsepol/cil/src/cil_build_ast.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/libsepol/cil/src/cil_build_ast.c b/libsepol/cil/src/cil_build_ast.c
|
|
index 67801def0..d5b9977c0 100644
|
|
--- a/libsepol/cil/src/cil_build_ast.c
|
|
+++ b/libsepol/cil/src/cil_build_ast.c
|
|
@@ -2714,7 +2714,7 @@ static int __cil_fill_constraint_leaf_expr(struct cil_tree_node *current, enum c
|
|
} else if (r_flavor == CIL_LIST) {
|
|
struct cil_list *sub_list;
|
|
cil_fill_list(current->next->next->cl_head, leaf_expr_flavor, &sub_list);
|
|
- cil_list_append(*leaf_expr, CIL_LIST, &sub_list);
|
|
+ cil_list_append(*leaf_expr, CIL_LIST, sub_list);
|
|
} else {
|
|
cil_list_append(*leaf_expr, CIL_CONS_OPERAND, (void *)r_flavor);
|
|
}
|