[PATCH 2/5] libselinux: label_file: check next_entry() when skipping

When a file_contexts.bin file has a different regex version or
architecture string length, load_mmap_common() skips over the string
and treats it as a mismatch. However, the skip is not checked, so a
length that exceeds the remaining mapping de-synchronizes the
parser. Every subsequent read is still bounds checked so there is no
OOB read but the file will be mis-parsed rather than cleanly rejected.
Check the call to next_entry() when skipping and handle as an error.

Signed-off-by: Stephen Smalley <[email protected]>
---
 libselinux/src/label_file.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index 0c0499eb..427e4071 100644
--- a/libselinux/src/label_file.c
+++ b/libselinux/src/label_file.c
@@ -963,7 +963,9 @@ FUZZ_EXTERN int load_mmap(FILE *fp, const size_t len,
 		 * Skip the entry and conclude that we have
 		 * a mismatch, which is not fatal.
 		 */
-		next_entry(NULL, mmap_area, pcre_ver_len);
+		rc = next_entry(NULL, mmap_area, pcre_ver_len);
+		if (rc < 0)
+			goto err;
 		goto end_version_check;
 	}
 
@@ -1005,7 +1007,9 @@ end_version_check:
 		 * Skip the entry and conclude that we have
 		 * a mismatch, which is not fatal.
 		 */
-		next_entry(NULL, mmap_area, pcre_arch_len);
+		rc = next_entry(NULL, mmap_area, pcre_arch_len);
+		if (rc < 0)
+			goto err;
 		goto end_arch_check;
 	}
 
-- 
2.55.0