summaryrefslogtreecommitdiffstats
path: root/security/apparmor
diff options
context:
space:
mode:
authorJohn Johansen <john.johansen@canonical.com>2020-03-31 08:37:54 +0200
committerJohn Johansen <john.johansen@canonical.com>2020-04-08 13:42:48 +0200
commitc27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c (patch)
treeb7554ab191015fca33af785fc7affbf33fae7f91 /security/apparmor
parentapparmor: remove duplicate check of xattrs on profile attachment. (diff)
downloadlinux-c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c.tar.xz
linux-c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c.zip
apparmor: ensure that dfa state tables have entries
Currently it is possible to specify a state machine table with 0 length, this is not valid as optional tables are specified by not defining the table as present. Further this allows by-passing the base tables range check against the next/check tables. Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers") Reported-by: Mike Salvatore <mike.salvatore@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r--security/apparmor/match.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index e605b7d53fb4..3e9e1eaf990e 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -97,6 +97,9 @@ static struct table_header *unpack_table(char *blob, size_t bsize)
th.td_flags == YYTD_DATA8))
goto out;
+ /* if we have a table it must have some entries */
+ if (th.td_lolen == 0)
+ goto out;
tsize = table_size(th.td_lolen, th.td_flags);
if (bsize < tsize)
goto out;
@@ -198,6 +201,8 @@ static int verify_dfa(struct aa_dfa *dfa)
state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;
+ if (state_count == 0)
+ goto out;
for (i = 0; i < state_count; i++) {
if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&
(DEFAULT_TABLE(dfa)[i] >= state_count))