selinux: detect invalid ebitmap

When count is 0 and the highbit is not zero, the ebitmap is not valid and the internal node is not allocated. This causes issues when routines, like mls_context_isvalid() attempt to use the ebitmap_for_each_bit() and ebitmap_node_get_bit() as they assume a highbit > 0 will have a node allocated. Signed-off-by: William Roberts <[email protected]> Signed-off-by: Paul Moore <[email protected]>
jix · Aug 29, 2016 · 74d977b · 74d977b
1 parent 348a0db
commit 74d977b
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
@@ -374,6 +374,9 @@ int ebitmap_read(struct ebitmap *e, void *fp)
 		goto ok;
 	}
 
+	if (e->highbit && !count)
+		goto bad;
+
 	for (i = 0; i < count; i++) {
 		rc = next_entry(&startbit, fp, sizeof(u32));
 		if (rc < 0) {