MSVSphere Packaging Team
3 months ago
parent
6a4b74db8d
commit
2176882f7f
GPG Key ID:
B2B0B9F29E528FE8
@ -0,0 +1,40 @@
|
|||||||
|
From d045edd5298a75284ce1cc289d039cce8b7a24ae Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Tue, 23 Jul 2024 16:41:57 +0200
|
||||||
|
Subject: [PATCH] libsepol/cil: Check that sym_index is within bounds
|
||||||
|
|
||||||
|
Make sure sym_index is within the bounds of symtab array before using it
|
||||||
|
to index the array.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Error: OVERRUN (CWE-119):
|
||||||
|
libsepol-3.6/cil/src/cil_resolve_ast.c:3157: assignment: Assigning: "sym_index" = "CIL_SYM_UNKNOWN".
|
||||||
|
libsepol-3.6/cil/src/cil_resolve_ast.c:3189: overrun-call: Overrunning callee's array of size 19 by passing argument "sym_index" (which evaluates to 20) in call to "cil_resolve_name".
|
||||||
|
\# 3187| switch (curr->flavor) {
|
||||||
|
\# 3188| case CIL_STRING:
|
||||||
|
\# 3189|-> rc = cil_resolve_name(parent, curr->data, sym_index, db, &res_datum);
|
||||||
|
\# 3190| if (rc != SEPOL_OK) {
|
||||||
|
\# 3191| goto exit;
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
libsepol/cil/src/cil_resolve_ast.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
|
||||||
|
index 427a320c..da8863c4 100644
|
||||||
|
--- a/libsepol/cil/src/cil_resolve_ast.c
|
||||||
|
+++ b/libsepol/cil/src/cil_resolve_ast.c
|
||||||
|
@@ -4291,7 +4291,7 @@ int cil_resolve_name_keep_aliases(struct cil_tree_node *ast_node, char *name, en
|
||||||
|
int rc = SEPOL_ERR;
|
||||||
|
struct cil_tree_node *node = NULL;
|
||||||
|
|
||||||
|
- if (name == NULL) {
|
||||||
|
+ if (name == NULL || sym_index >= CIL_SYM_NUM) {
|
||||||
|
cil_log(CIL_ERR, "Invalid call to cil_resolve_name\n");
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.47.0
|
||||||
|
|
||||||
@ -0,0 +1,81 @@
|
|||||||
|
From b332edfc248f7c5bcf651be033e2f06aa5959776 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 23 Oct 2024 15:43:15 +0200
|
||||||
|
Subject: [PATCH] libsepol/cil: Initialize avtab_datum on declaration
|
||||||
|
|
||||||
|
avtab_datum.xperms was not always initialized before being used.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/cil/src/cil_binary.c:977:2: var_decl: Declaring variable "avtab_datum" without initializer.
|
||||||
|
libsepol-3.7/cil/src/cil_binary.c:1059:3: uninit_use_in_call: Using uninitialized value "avtab_datum". Field "avtab_datum.xperms" is uninitialized when calling "__cil_cond_insert_rule".
|
||||||
|
\# 1057| }
|
||||||
|
\# 1058| }
|
||||||
|
\# 1059|-> rc = __cil_cond_insert_rule(&pdb->te_cond_avtab, &avtab_key, &avtab_datum, cond_node, cond_flavor);
|
||||||
|
\# 1060| }
|
||||||
|
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/cil/src/cil_binary.c:1348:2: var_decl: Declaring variable "avtab_datum" without initializer.
|
||||||
|
libsepol-3.7/cil/src/cil_binary.c:1384:3: uninit_use_in_call: Using uninitialized value "avtab_datum". Field "avtab_datum.xperms" is uninitialized when calling "__cil_cond_insert_rule".
|
||||||
|
\# 1382| } else {
|
||||||
|
\# 1383| avtab_datum.data = data;
|
||||||
|
\# 1384|-> rc = __cil_cond_insert_rule(&pdb->te_cond_avtab, &avtab_key, &avtab_datum, cond_node, cond_flavor);
|
||||||
|
\# 1385| }
|
||||||
|
\# 1386|
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
libsepol/cil/src/cil_binary.c | 8 ++------
|
||||||
|
1 file changed, 2 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
|
||||||
|
index c8144a5a..66c461eb 100644
|
||||||
|
--- a/libsepol/cil/src/cil_binary.c
|
||||||
|
+++ b/libsepol/cil/src/cil_binary.c
|
||||||
|
@@ -974,7 +974,7 @@ static int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t src,
|
||||||
|
{
|
||||||
|
int rc = SEPOL_OK;
|
||||||
|
avtab_key_t avtab_key;
|
||||||
|
- avtab_datum_t avtab_datum;
|
||||||
|
+ avtab_datum_t avtab_datum = { .data = res, .xperms = NULL };
|
||||||
|
avtab_ptr_t existing;
|
||||||
|
|
||||||
|
avtab_key.source_type = src;
|
||||||
|
@@ -996,8 +996,6 @@ static int __cil_insert_type_rule(policydb_t *pdb, uint32_t kind, uint32_t src,
|
||||||
|
goto exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
- avtab_datum.data = res;
|
||||||
|
-
|
||||||
|
existing = avtab_search_node(&pdb->te_avtab, &avtab_key);
|
||||||
|
if (existing) {
|
||||||
|
/* Don't add duplicate type rule and warn if they conflict.
|
||||||
|
@@ -1345,7 +1343,7 @@ static int __cil_insert_avrule(policydb_t *pdb, uint32_t kind, uint32_t src, uin
|
||||||
|
{
|
||||||
|
int rc = SEPOL_OK;
|
||||||
|
avtab_key_t avtab_key;
|
||||||
|
- avtab_datum_t avtab_datum;
|
||||||
|
+ avtab_datum_t avtab_datum = { .data = data, .xperms = NULL };
|
||||||
|
avtab_datum_t *avtab_dup = NULL;
|
||||||
|
|
||||||
|
avtab_key.source_type = src;
|
||||||
|
@@ -1371,7 +1369,6 @@ static int __cil_insert_avrule(policydb_t *pdb, uint32_t kind, uint32_t src, uin
|
||||||
|
if (!cond_node) {
|
||||||
|
avtab_dup = avtab_search(&pdb->te_avtab, &avtab_key);
|
||||||
|
if (!avtab_dup) {
|
||||||
|
- avtab_datum.data = data;
|
||||||
|
rc = avtab_insert(&pdb->te_avtab, &avtab_key, &avtab_datum);
|
||||||
|
} else {
|
||||||
|
if (kind == CIL_AVRULE_DONTAUDIT)
|
||||||
|
@@ -1380,7 +1377,6 @@ static int __cil_insert_avrule(policydb_t *pdb, uint32_t kind, uint32_t src, uin
|
||||||
|
avtab_dup->data |= data;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
- avtab_datum.data = data;
|
||||||
|
rc = __cil_cond_insert_rule(&pdb->te_cond_avtab, &avtab_key, &avtab_datum, cond_node, cond_flavor);
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.47.0
|
||||||
|
|
||||||
@ -0,0 +1,74 @@
|
|||||||
|
From a67e7419e09e8954dd8d96baaab9ee663a00990c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 23 Oct 2024 15:43:16 +0200
|
||||||
|
Subject: [PATCH] libsepol/mls: Do not destroy context on memory error
|
||||||
|
|
||||||
|
In case of malloc error, ctx1, or ctx2 may be pointing to uninitialized
|
||||||
|
space and context_destroy should not be used on it.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/src/mls.c:673:2: alloc_fn: Calling "malloc" which returns uninitialized memory.
|
||||||
|
libsepol-3.7/src/mls.c:673:2: assign: Assigning: "ctx1" = "malloc(64UL)", which points to uninitialized data.
|
||||||
|
libsepol-3.7/src/mls.c:699:2: uninit_use_in_call: Using uninitialized value "ctx1->range.level[0].cat.node" when calling "context_destroy".
|
||||||
|
\# 697| ERR(handle, "could not check if mls context %s contains %s",
|
||||||
|
\# 698| mls1, mls2);
|
||||||
|
\# 699|-> context_destroy(ctx1);
|
||||||
|
\# 700| context_destroy(ctx2);
|
||||||
|
\# 701| free(ctx1);
|
||||||
|
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/src/mls.c:674:2: alloc_fn: Calling "malloc" which returns uninitialized memory.
|
||||||
|
libsepol-3.7/src/mls.c:674:2: assign: Assigning: "ctx2" = "malloc(64UL)", which points to uninitialized data.
|
||||||
|
libsepol-3.7/src/mls.c:700:2: uninit_use_in_call: Using uninitialized value "ctx2->range.level[0].cat.node" when calling "context_destroy".
|
||||||
|
\# 698| mls1, mls2);
|
||||||
|
\# 699| context_destroy(ctx1);
|
||||||
|
\# 700|-> context_destroy(ctx2);
|
||||||
|
\# 701| free(ctx1);
|
||||||
|
\# 702| free(ctx2);
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
libsepol/src/mls.c | 12 ++++++------
|
||||||
|
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libsepol/src/mls.c b/libsepol/src/mls.c
|
||||||
|
index 45db8920..a37405d1 100644
|
||||||
|
--- a/libsepol/src/mls.c
|
||||||
|
+++ b/libsepol/src/mls.c
|
||||||
|
@@ -672,8 +672,10 @@ int sepol_mls_contains(sepol_handle_t * handle,
|
||||||
|
context_struct_t *ctx1 = NULL, *ctx2 = NULL;
|
||||||
|
ctx1 = malloc(sizeof(context_struct_t));
|
||||||
|
ctx2 = malloc(sizeof(context_struct_t));
|
||||||
|
- if (ctx1 == NULL || ctx2 == NULL)
|
||||||
|
+ if (ctx1 == NULL || ctx2 == NULL){
|
||||||
|
+ ERR(handle, "out of memory");
|
||||||
|
goto omem;
|
||||||
|
+ }
|
||||||
|
context_init(ctx1);
|
||||||
|
context_init(ctx2);
|
||||||
|
|
||||||
|
@@ -690,16 +692,14 @@ int sepol_mls_contains(sepol_handle_t * handle,
|
||||||
|
free(ctx2);
|
||||||
|
return STATUS_SUCCESS;
|
||||||
|
|
||||||
|
- omem:
|
||||||
|
- ERR(handle, "out of memory");
|
||||||
|
-
|
||||||
|
err:
|
||||||
|
- ERR(handle, "could not check if mls context %s contains %s",
|
||||||
|
- mls1, mls2);
|
||||||
|
context_destroy(ctx1);
|
||||||
|
context_destroy(ctx2);
|
||||||
|
+ omem:
|
||||||
|
free(ctx1);
|
||||||
|
free(ctx2);
|
||||||
|
+ ERR(handle, "could not check if mls context %s contains %s",
|
||||||
|
+ mls1, mls2);
|
||||||
|
return STATUS_ERR;
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.47.0
|
||||||
|
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
From 77e225361129f02d379e930859406a61420836d7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 23 Oct 2024 15:43:17 +0200
|
||||||
|
Subject: [PATCH] libsepol/cil/cil_post: Initialize tmp on declaration
|
||||||
|
|
||||||
|
tmp.node was not always initialized before being used by
|
||||||
|
ebitmap_destroy.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/cil/src/cil_post.c:1309:2: var_decl: Declaring variable "tmp" without initializer.
|
||||||
|
libsepol-3.7/cil/src/cil_post.c:1382:6: uninit_use_in_call: Using uninitialized value "tmp.node" when calling "ebitmap_destroy".
|
||||||
|
\# 1380| if (rc != SEPOL_OK) {
|
||||||
|
\# 1381| cil_log(CIL_INFO, "Failed to apply operator to bitmaps\n");
|
||||||
|
\# 1382|-> ebitmap_destroy(&tmp);
|
||||||
|
\# 1383| goto exit;
|
||||||
|
\# 1384| }
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
libsepol/cil/src/cil_post.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
|
||||||
|
index ac99997f..d63a5496 100644
|
||||||
|
--- a/libsepol/cil/src/cil_post.c
|
||||||
|
+++ b/libsepol/cil/src/cil_post.c
|
||||||
|
@@ -1315,6 +1315,8 @@ static int __cil_expr_to_bitmap(struct cil_list *expr, ebitmap_t *out, int max,
|
||||||
|
curr = expr->head;
|
||||||
|
flavor = expr->flavor;
|
||||||
|
|
||||||
|
+ ebitmap_init(&tmp);
|
||||||
|
+
|
||||||
|
if (curr->flavor == CIL_OP) {
|
||||||
|
enum cil_flavor op = (enum cil_flavor)(uintptr_t)curr->data;
|
||||||
|
|
||||||
|
--
|
||||||
|
2.47.0
|
||||||
|
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
From 49926e313ca995ae72d5b6bd82f3f5bbbe5ba0df Mon Sep 17 00:00:00 2001
|
||||||
|
From: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Date: Wed, 23 Oct 2024 15:43:18 +0200
|
||||||
|
Subject: [PATCH] libsepol: Initialize "strs" on declaration
|
||||||
|
|
||||||
|
The value of "strs" was not always initialized before being used by
|
||||||
|
strs_destroy.
|
||||||
|
|
||||||
|
Fixes:
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/src/kernel_to_cil.c:1439:2: var_decl: Declaring variable "strs" without initializer.
|
||||||
|
libsepol-3.7/src/kernel_to_cil.c:1487:2: uninit_use_in_call: Using uninitialized value "strs" when calling "strs_destroy".
|
||||||
|
\# 1485|
|
||||||
|
\# 1486| exit:
|
||||||
|
\# 1487|-> strs_destroy(&strs);
|
||||||
|
\# 1488|
|
||||||
|
\# 1489| if (rc != 0) {
|
||||||
|
|
||||||
|
Error: UNINIT (CWE-457):
|
||||||
|
libsepol-3.7/src/kernel_to_conf.c:1422:2: var_decl: Declaring variable "strs" without initializer.
|
||||||
|
libsepol-3.7/src/kernel_to_conf.c:1461:2: uninit_use_in_call: Using uninitialized value "strs" when calling "strs_destroy".
|
||||||
|
\# 1459|
|
||||||
|
\# 1460| exit:
|
||||||
|
\# 1461|-> strs_destroy(&strs);
|
||||||
|
\# 1462|
|
||||||
|
\# 1463| if (rc != 0) {
|
||||||
|
|
||||||
|
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||||
|
Acked-by: James Carter <jwcart2@gmail.com>
|
||||||
|
---
|
||||||
|
libsepol/src/kernel_to_cil.c | 2 +-
|
||||||
|
libsepol/src/kernel_to_conf.c | 2 +-
|
||||||
|
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
|
||||||
|
index f94cb245..9c2690be 100644
|
||||||
|
--- a/libsepol/src/kernel_to_cil.c
|
||||||
|
+++ b/libsepol/src/kernel_to_cil.c
|
||||||
|
@@ -1436,7 +1436,7 @@ static int map_type_aliases_to_strs(char *key, void *data, void *args)
|
||||||
|
static int write_type_alias_rules_to_cil(FILE *out, struct policydb *pdb)
|
||||||
|
{
|
||||||
|
type_datum_t *alias;
|
||||||
|
- struct strs *strs;
|
||||||
|
+ struct strs *strs = NULL;
|
||||||
|
char *name;
|
||||||
|
char *type;
|
||||||
|
unsigned i, num = 0;
|
||||||
|
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
|
||||||
|
index ca91ffae..661546af 100644
|
||||||
|
--- a/libsepol/src/kernel_to_conf.c
|
||||||
|
+++ b/libsepol/src/kernel_to_conf.c
|
||||||
|
@@ -1419,7 +1419,7 @@ static int map_type_aliases_to_strs(char *key, void *data, void *args)
|
||||||
|
static int write_type_alias_rules_to_conf(FILE *out, struct policydb *pdb)
|
||||||
|
{
|
||||||
|
type_datum_t *alias;
|
||||||
|
- struct strs *strs;
|
||||||
|
+ struct strs *strs = NULL;
|
||||||
|
char *name;
|
||||||
|
char *type;
|
||||||
|
unsigned i, num = 0;
|
||||||
|
--
|
||||||
|
2.47.0
|
||||||
|
|
||||||
Loading…
Reference in new issue