diff options
author | John Johansen <john.johansen@canonical.com> | 2020-03-30 23:37:54 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-07-22 09:32:06 +0200 |
commit | fe1219a2893fe93cec9a3217c3c2d5113365e26a (patch) | |
tree | 44569d99fac177522c8e8695392e2d7cdb50d34a /security | |
parent | f9851f7ad4ea488173f1f89ff7aafb1dfb0b84e4 (diff) | |
download | linux-stable-fe1219a2893fe93cec9a3217c3c2d5113365e26a.tar.gz linux-stable-fe1219a2893fe93cec9a3217c3c2d5113365e26a.tar.bz2 linux-stable-fe1219a2893fe93cec9a3217c3c2d5113365e26a.zip |
apparmor: ensure that dfa state tables have entries
commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream.
Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.
Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")
Reported-by: Mike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'security')
-rw-r--r-- | security/apparmor/match.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/security/apparmor/match.c b/security/apparmor/match.c index 55f2ee505a01..c1b96a3841da 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -101,6 +101,9 @@ static struct table_header *unpack_table(char *blob, size_t bsize) th.td_flags == YYTD_DATA8)) goto out; + /* if we have a table it must have some entries */ + if (th.td_lolen == 0) + goto out; tsize = table_size(th.td_lolen, th.td_flags); if (bsize < tsize) goto out; @@ -202,6 +205,8 @@ static int verify_dfa(struct aa_dfa *dfa) state_count = dfa->tables[YYTD_ID_BASE]->td_lolen; trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen; + if (state_count == 0) + goto out; for (i = 0; i < state_count; i++) { if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) && (DEFAULT_TABLE(dfa)[i] >= state_count)) |