[PATCH] selinux: check processed security context length

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes security_context_to_sid to check the length of the
processed security context against the full length of the provided context,
rejecting any further data.

Signed-off-by: Stephen Smalley <sds@epoch.ncsc.mil>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index aa1b54c4708b29a426f90cd798e67d1a67cc2006..f54ad88d487331f960170298b5c183ab4daf53c9 100644 (file)
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -290,7 +290,7 @@ int mls_context_to_sid(char oldc,
                if (rc)
                        goto out;
        }
-       *scontext = p;
+       *scontext = ++p;
        rc = 0;
 out:
        return rc;

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 7d0fedf04179398d9765b71f13cf657ae8dc3c24..21ab4c975f6064730787f33cbfb4442db76fe72c 100644 (file)
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -532,6 +532,11 @@ int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid)
        if (rc)
                goto out_unlock;
 
+       if ((p - scontext2) < scontext_len) {
+               rc = -EINVAL;
+               goto out_unlock;
+       }
+
        /* Check the validity of the new context. */
        if (!policydb_context_isvalid(&policydb, &context)) {
                rc = -EINVAL;