diff mbox

[05/14] UBUNTU: SAUCE: apparmor: Add missing id bounds check on dfa verification

Message ID 1471943154-14507-6-git-send-email-john.johansen@canonical.com
State New
Headers show

Commit Message

John Johansen Aug. 23, 2016, 9:05 a.m. UTC 
BugLink: http://bugs.launchpad.net/bugs/1615882

Signed-off-by: John Johansen <john.johansen@canonical.com>
---
 security/apparmor/include/match.h | 1 +
 security/apparmor/match.c         | 2 ++
 2 files changed, 3 insertions(+)
diff mbox

Patch

diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index d333b34..a85bb3b 100644
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -62,6 +62,7 @@  struct table_set_header {
 #define YYTD_ID_ACCEPT2 6
 #define YYTD_ID_NXT	7
 #define YYTD_ID_TSIZE	8
+#define YYTD_ID_MAX	8
 
 #define YYTD_DATA8	1
 #define YYTD_DATA16	2
diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index 4fe2641..68e4a26 100644
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -74,6 +74,8 @@  static struct table_header *unpack_table(char *blob, size_t bsize)
 	 * it every time we use td_id as an index
 	 */
 	th.td_id = be16_to_cpu(*(u16 *) (blob)) - 1;
+	if (th.td_id > YYTD_ID_MAX)
+		goto out;
 	th.td_flags = be16_to_cpu(*(u16 *) (blob + 2));
 	th.td_lolen = be32_to_cpu(*(u32 *) (blob + 8));
 	blob += sizeof(struct table_header);