selinux: Add boundary check in put_entry()

Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access. Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
milkv-pioneer · Jun 15, 2022 · 15ec76f · 15ec76f
1 parent 73de1be
commit 15ec76f
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
@@ -370,6 +370,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic
 {
 	size_t len = bytes * num;
 
+	if (len > fp->len)
+		return -EINVAL;
 	memcpy(fp->data, buf, len);
 	fp->data += len;
 	fp->len -= len;