From 74d977b65e45bc9b536b429e7f3b5e3a8e459026 Mon Sep 17 00:00:00 2001 From: William Roberts Date: Tue, 23 Aug 2016 13:49:23 -0700 Subject: selinux: detect invalid ebitmap When count is 0 and the highbit is not zero, the ebitmap is not valid and the internal node is not allocated. This causes issues when routines, like mls_context_isvalid() attempt to use the ebitmap_for_each_bit() and ebitmap_node_get_bit() as they assume a highbit > 0 will have a node allocated. Signed-off-by: William Roberts Signed-off-by: Paul Moore --- security/selinux/ss/ebitmap.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'security/selinux/ss/ebitmap.c') diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c index 894b6cdc11c5..7d10e5d418bb 100644 --- a/security/selinux/ss/ebitmap.c +++ b/security/selinux/ss/ebitmap.c @@ -374,6 +374,9 @@ int ebitmap_read(struct ebitmap *e, void *fp) goto ok; } + if (e->highbit && !count) + goto bad; + for (i = 0; i < count; i++) { rc = next_entry(&startbit, fp, sizeof(u32)); if (rc < 0) { -- cgit v1.2.3-59-g8ed1b