Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fe1219a2 authored by John Johansen's avatar John Johansen Committed by Greg Kroah-Hartman
Browse files

apparmor: ensure that dfa state tables have entries 



commit c27c6bd2c4d6b6bb779f9b722d5607993e1d5e5c upstream.

Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.

Fixes: d901d6a2 ("apparmor: dfa split verification of table headers")
Reported-by: default avatarMike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f9851f7a

security/apparmor/match.c

+5 −0
Original line number Diff line number Diff line
@@ -101,6 +101,9 @@ static struct table_header *unpack_table(char *blob, size_t bsize) 
	      th.td_flags == YYTD_DATA8))

		goto out;



	/* if we have a table it must have some entries */

	if (th.td_lolen == 0)

		goto out;

	tsize = table_size(th.td_lolen, th.td_flags);

	if (bsize < tsize)

		goto out;
@@ -202,6 +205,8 @@ static int verify_dfa(struct aa_dfa *dfa) 


	state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;

	trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;

	if (state_count == 0)

		goto out;

	for (i = 0; i < state_count; i++) {

		if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&

		    (DEFAULT_TABLE(dfa)[i] >= state_count))