|
 |
71cd55 |
From c5e6153720e713e72a65614f625a51ad44d1fc07 Mon Sep 17 00:00:00 2001
|
|
|
71cd55 |
From: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
|
71cd55 |
Date: Sun, 14 Mar 2021 19:25:58 +0100
|
|
|
71cd55 |
Subject: [PATCH] libsepol/cil: fix NULL pointer dereference in
|
|
|
71cd55 |
__cil_insert_name
|
|
|
71cd55 |
|
|
|
71cd55 |
OSS-Fuzz found a Null-dereference in __cil_insert_name when trying to
|
|
|
71cd55 |
compile the following policy:
|
|
|
71cd55 |
|
|
|
71cd55 |
(macro MACRO ()
|
|
|
71cd55 |
(classmap CLASS (PERM))
|
|
|
71cd55 |
(type TYPE)
|
|
|
71cd55 |
(typetransition TYPE TYPE CLASS "name" TYPE)
|
|
|
71cd55 |
)
|
|
|
71cd55 |
(call MACRO)
|
|
|
71cd55 |
|
|
|
71cd55 |
When using a macro with no argument, macro->params is NULL and
|
|
|
71cd55 |
cil_list_for_each(item, macro->params) dereferenced a NULL pointer.
|
|
|
71cd55 |
Fix this by checking that macro->params is not NULL before using it.
|
|
|
71cd55 |
|
|
|
71cd55 |
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28565
|
|
|
71cd55 |
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
|
|
|
71cd55 |
---
|
|
|
71cd55 |
libsepol/cil/src/cil_resolve_ast.c | 2 +-
|
|
|
71cd55 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
71cd55 |
|
|
|
71cd55 |
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
index 2ea106d63505..63beed9230b9 100644
|
|
|
71cd55 |
--- a/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
|
|
71cd55 |
@@ -82,7 +82,7 @@ static struct cil_name * __cil_insert_name(struct cil_db *db, hashtab_key_t key,
|
|
|
71cd55 |
} else if (parent->flavor == CIL_MACRO) {
|
|
|
71cd55 |
macro = parent->data;
|
|
|
71cd55 |
}
|
|
|
71cd55 |
- if (macro != NULL) {
|
|
|
71cd55 |
+ if (macro != NULL && macro->params != NULL) {
|
|
|
71cd55 |
struct cil_list_item *item;
|
|
|
71cd55 |
cil_list_for_each(item, macro->params) {
|
|
|
71cd55 |
if (((struct cil_param*)item->data)->str == key) {
|
|
|
71cd55 |
--
|
|
|
71cd55 |
2.32.0
|
|
|
71cd55 |
|