From 863dacddb3d17e76f1345d2e030d6c481b5d62fd Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Wed, 2 Jun 2004 17:59:21 -0700 Subject: [PATCH] [PATCH] selinux: check processed security context length From: Stephen Smalley This patch changes security_context_to_sid to check the length of the processed security context against the full length of the provided context, rejecting any further data. Signed-off-by: Stephen Smalley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- security/selinux/ss/mls.c | 2 +- security/selinux/ss/services.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c index aa1b54c4708b2..f54ad88d48733 100644 --- a/security/selinux/ss/mls.c +++ b/security/selinux/ss/mls.c @@ -290,7 +290,7 @@ int mls_context_to_sid(char oldc, if (rc) goto out; } - *scontext = p; + *scontext = ++p; rc = 0; out: return rc; diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 7d0fedf041793..21ab4c975f606 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -532,6 +532,11 @@ int security_context_to_sid(char *scontext, u32 scontext_len, u32 *sid) if (rc) goto out_unlock; + if ((p - scontext2) < scontext_len) { + rc = -EINVAL; + goto out_unlock; + } + /* Check the validity of the new context. */ if (!policydb_context_isvalid(&policydb, &context)) { rc = -EINVAL; -- 2.53.0