tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libsepol/cil: make cil_resolve_name() fail for '.'

Browse source 
This CIL policy makes secilc crash with a NULL pointer dereference:

    (class CLASS (PERM))
    (classorder (CLASS))
    (sid SID)
    (sidorder (SID))
    (user USER)
    (role ROLE)
    (type TYPE)
    (category CAT)
    (categoryorder (CAT))
    (sensitivity SENS)
    (sensitivityorder (SENS))
    (sensitivitycategory SENS (CAT))
    (allow TYPE self (CLASS (PERM)))
    (roletype ROLE TYPE)
    (userrole USER ROLE)
    (userlevel USER (SENS))
    (userrange USER ((SENS)(SENS (CAT))))
    (sidcontext SID (USER ROLE TYPE ((SENS)(SENS))))

    (allow . self (CLASS (PERM)))

Using "." in the allow statement makes strtok_r() return NULL in
cil_resolve_name() and this result is then used in a call to
cil_symtab_get_datum(), which is thus invalid.

Instead of crashing, make secilc fail with an error message.

This bug has been found by fuzzing secilc with american fuzzy lop.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2016-10-03 22:46:55 +02:00 committed by James Carter
parent 5694d26839
commit f1ba58a199
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
libsepol/cil/src/cil_resolve_ast.c
View file

@ -4027,7 +4027,14 @@ int cil_resolve_name(struct cil_tree_node *ast_node, char *name, enum cil_sym_in
char *current = strtok_r(name_dup, ".", &sp);
char *next = strtok_r(NULL, ".", &sp);
symtab_t *symtab = NULL;
if (current == NULL) {
/* Only dots */
cil_tree_log(ast_node, CIL_ERR, "Invalid name %s", name);
free(name_dup);
goto exit;
}
node = ast_node;
if (*name == '.') {
/* Leading '.' */