diff options
| author | Richard Haines <richard_c_haines@btinternet.com> | 2015-05-07 15:40:53 +0100 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2015-05-07 12:00:07 -0400 |
| commit | a351eb01a8238c1bd465619c6c5885c2da1c6663 (patch) | |
| tree | 0dc1122c129103b21dfa5396d2c7a35c818a919d /libselinux/src/label_file.c | |
| parent | 4d0d9c7004eece16f57bd794852cf721158e06e7 (diff) | |
| download | android_external_selinux-a351eb01a8238c1bd465619c6c5885c2da1c6663.tar.gz android_external_selinux-a351eb01a8238c1bd465619c6c5885c2da1c6663.tar.bz2 android_external_selinux-a351eb01a8238c1bd465619c6c5885c2da1c6663.zip | |
libselinux: Fix core dumps with corrupt *.bin files
Check buffer address limits when processing *.bin files
to catch any over-runs. On failure process text file instead.
To test, the bin files were corrupted by adding and removing
various bits of data. Various file sizes were also checked and
all were caught by the patch.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Diffstat (limited to 'libselinux/src/label_file.c')
| -rw-r--r-- | libselinux/src/label_file.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c index b3e56713..c722f299 100644 --- a/libselinux/src/label_file.c +++ b/libselinux/src/label_file.c @@ -325,6 +325,8 @@ static int load_mmap(struct selabel_handle *rec, const char *path, struct stat * addr += sizeof(uint32_t); if (memcmp((char *)addr, pcre_version(), len)) return -1; /* pcre version content mismatch */ + if (addr + *plen >= (char *)mmap_area->addr + mmap_area->len) + return -1; /* Buffer over-run */ addr += *plen; } @@ -390,11 +392,15 @@ static int load_mmap(struct selabel_handle *rec, const char *path, struct stat * if (!spec->lr.ctx_raw) goto err; + if (addr + *plen >= (char *)mmap_area->addr + mmap_area->len) + return -1; addr += *plen; plen = (uint32_t *)addr; addr += sizeof(uint32_t); spec->regex_str = (char *)addr; + if (addr + *plen >= (char *)mmap_area->addr + mmap_area->len) + return -1; addr += *plen; spec->mode = *(mode_t *)addr; @@ -415,12 +421,16 @@ static int load_mmap(struct selabel_handle *rec, const char *path, struct stat * plen = (uint32_t *)addr; addr += sizeof(uint32_t); spec->regex = (pcre *)addr; + if (addr + *plen >= (char *)mmap_area->addr + mmap_area->len) + return -1; addr += *plen; plen = (uint32_t *)addr; addr += sizeof(uint32_t); spec->lsd.study_data = (void *)addr; spec->lsd.flags |= PCRE_EXTRA_STUDY_DATA; + if (addr + *plen >= (char *)mmap_area->addr + mmap_area->len) + return -1; addr += *plen; data->nspec++; |