Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

checkpolicy/oss-fuzz: add libfuzz based fuzzer #313

Closed
wants to merge 15 commits into from
Closed

checkpolicy/oss-fuzz: add libfuzz based fuzzer #313

Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
8aed880
checkpolicy: add libfuzz based fuzzer
cgzones Jan 22, 2024
e7ba55f
checkpolicy: cleanup resources on parse error
cgzones Jan 22, 2024
748bbaf
checkpolicy: cleanup identifiers on error
cgzones Jan 22, 2024
7a38093
checkpolicy: free ebitmap on error
cgzones Jan 22, 2024
8ec2078
checkpolicy: check allocation and free memory on error at type defini…
cgzones Jan 22, 2024
cf8fcbc
checkpolicy: clean expression on error
cgzones Jan 22, 2024
b8d7c36
checkpolicy: call YYABORT on parse errors
cgzones Jan 22, 2024
ee32f0b
checkpolicy: bail out on invalid role
cgzones Jan 22, 2024
7a21205
libsepol: use typedef
cgzones Jan 22, 2024
ce8ddaf
libsepol: add copy member to level_datum
cgzones Jan 22, 2024
ecb67d0
checkpolicy: fix use-after-free on invalid sens alias
cgzones Jan 22, 2024
9c7b2be
checkpolicy: provide more descriptive error messages
cgzones Jan 22, 2024
42fd67e
checkpolicy: free temporary bounds type
cgzones Jan 22, 2024
7f429a8
checkpolicy: avoid assigning garbage values
cgzones Jan 22, 2024
d4bb604
checkpolicy: misc policy_define.c cleanup
cgzones Jan 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Prev Previous commit
Next Next commit
checkpolicy: cleanup identifiers on error 
Free identifiers removed from the queue but not yet owned by the policy
on errors.

Signed-off-by: Christian Göttsche <[email protected]>
  • Loading branch information
@cgzones
cgzones committed Jan 22, 2024
commit 748bbafcc039d9e01f6f187cb91cae911e300335
32 changes: 28 additions & 4 deletions checkpolicy/policy_define.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,6 +342,7 @@ static int read_classes(ebitmap_t *e_classes)
while ((id = queue_remove(id_queue))) {
if (!is_id_in_scope(SYM_CLASSES, id)) {
yyerror2("class %s is not within scope", id);
free(id);
return -1;
}
cladatum = hashtab_search(policydbp->p_classes.table, id);
Expand Down Expand Up @@ -373,15 +374,18 @@ int define_default_user(int which)
while ((id = queue_remove(id_queue))) {
if (!is_id_in_scope(SYM_CLASSES, id)) {
yyerror2("class %s is not within scope", id);
free(id);
return -1;
}
cladatum = hashtab_search(policydbp->p_classes.table, id);
if (!cladatum) {
yyerror2("unknown class %s", id);
free(id);
return -1;
}
if (cladatum->default_user && cladatum->default_user != which) {
yyerror2("conflicting default user information for class %s", id);
free(id);
return -1;
}
cladatum->default_user = which;
Expand All @@ -405,15 +409,18 @@ int define_default_role(int which)
while ((id = queue_remove(id_queue))) {
if (!is_id_in_scope(SYM_CLASSES, id)) {
yyerror2("class %s is not within scope", id);
free(id);
return -1;
}
cladatum = hashtab_search(policydbp->p_classes.table, id);
if (!cladatum) {
yyerror2("unknown class %s", id);
free(id);
return -1;
}
if (cladatum->default_role && cladatum->default_role != which) {
yyerror2("conflicting default role information for class %s", id);
free(id);
return -1;
}
cladatum->default_role = which;
Expand All @@ -437,15 +444,18 @@ int define_default_type(int which)
while ((id = queue_remove(id_queue))) {
if (!is_id_in_scope(SYM_CLASSES, id)) {
yyerror2("class %s is not within scope", id);
free(id);
return -1;
}
cladatum = hashtab_search(policydbp->p_classes.table, id);
if (!cladatum) {
yyerror2("unknown class %s", id);
free(id);
return -1;
}
if (cladatum->default_type && cladatum->default_type != which) {
yyerror2("conflicting default type information for class %s", id);
free(id);
return -1;
}
cladatum->default_type = which;
Expand All @@ -469,15 +479,18 @@ int define_default_range(int which)
while ((id = queue_remove(id_queue))) {
if (!is_id_in_scope(SYM_CLASSES, id)) {
yyerror2("class %s is not within scope", id);
free(id);
return -1;
}
cladatum = hashtab_search(policydbp->p_classes.table, id);
if (!cladatum) {
yyerror2("unknown class %s", id);
free(id);
return -1;
}
if (cladatum->default_range && cladatum->default_range != which) {
yyerror2("conflicting default range information for class %s", id);
free(id);
return -1;
}
cladatum->default_range = which;
Expand Down Expand Up @@ -508,6 +521,7 @@ int define_common_perms(void)
comdatum = hashtab_search(policydbp->p_commons.table, id);
if (comdatum) {
yyerror2("duplicate declaration for common %s\n", id);
free(id);
return -1;
}
comdatum = (common_datum_t *) malloc(sizeof(common_datum_t));
Expand Down Expand Up @@ -770,12 +784,14 @@ int define_sens(void)
while ((id = queue_remove(id_queue))) {
if (id_has_dot(id)) {
yyerror("sensitivity aliases may not contain periods");
goto bad_alias;
free(id);
return -1;
}
aliasdatum = (level_datum_t *) malloc(sizeof(level_datum_t));
if (!aliasdatum) {
yyerror("out of memory");
goto bad_alias;
free(id);
return -1;
}
level_datum_init(aliasdatum);
aliasdatum->isalias = TRUE;
Expand Down Expand Up @@ -940,12 +956,14 @@ int define_category(void)
while ((id = queue_remove(id_queue))) {
if (id_has_dot(id)) {
yyerror("category aliases may not contain periods");
goto bad_alias;
free(id);
return -1;
}
aliasdatum = (cat_datum_t *) malloc(sizeof(cat_datum_t));
if (!aliasdatum) {
yyerror("out of memory");
goto bad_alias;
free(id);
return -1;
}
cat_datum_init(aliasdatum);
aliasdatum->isalias = TRUE;
Expand Down Expand Up @@ -3722,6 +3740,7 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
if (!is_id_in_scope(SYM_USERS, id)) {
yyerror2("user %s is not within scope",
id);
free(id);
constraint_expr_destroy(expr);
return 0;
}
Expand All @@ -3733,6 +3752,7 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
id);
if (!user) {
yyerror2("unknown user %s", id);
free(id);
constraint_expr_destroy(expr);
return 0;
}
Expand All @@ -3742,6 +3762,7 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
yyerror2("role %s is not within scope",
id);
constraint_expr_destroy(expr);
free(id);
return 0;
}
role =
Expand All @@ -3753,6 +3774,7 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
if (!role) {
yyerror2("unknown role %s", id);
constraint_expr_destroy(expr);
free(id);
return 0;
}
val = role->s.value;
Expand All @@ -3765,11 +3787,13 @@ uintptr_t define_cexpr(uint32_t expr_type, uintptr_t arg1, uintptr_t arg2)
} else {
yyerror("invalid constraint expression");
constraint_expr_destroy(expr);
free(id);
return 0;
}
if (ebitmap_set_bit(&expr->names, val - 1, TRUE)) {
yyerror("out of memory");
ebitmap_destroy(&expr->names);
free(id);
constraint_expr_destroy(expr);
return 0;
}
Expand Down