[PATCH 5/5] libselinux: label_db: prevent integer overflows on resizing

The label db backend resizing logic for the catalog is also prone to
integer overflows currently. Fix it in a similar manner as we have
done elsewhere. Note that the catalog_t contains the number of specs ,
the limit of the array, and an embedded variable length array of
spec_t, so we are doubling the old limit, then computing the size of
the array, then adding the catalog_t size.

Signed-off-by: Stephen Smalley <[email protected]>
---
 libselinux/src/label_db.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/libselinux/src/label_db.c b/libselinux/src/label_db.c
index bafa9328..feadb76e 100644
--- a/libselinux/src/label_db.c
+++ b/libselinux/src/label_db.c
@@ -318,10 +318,17 @@ static catalog_t *db_init(const struct selinux_opt *opts, unsigned nopts,
 		 */
 		if (catalog->limit == catalog->nspec) {
 			size_t length;
-			unsigned int new_limit = 2 * catalog->limit;
+			unsigned int new_limit;
 			catalog_t *new_catalog;
 
-			length = sizeof(catalog_t) + new_limit * sizeof(spec_t);
+			if (catalog->limit > UINT_MAX / 2)
+				goto out_error;
+			new_limit = 2 * catalog->limit;
+			if (__builtin_mul_overflow(new_limit, sizeof(spec_t),
+						   &length) ||
+			    __builtin_add_overflow(length, sizeof(catalog_t),
+						   &length))
+				goto out_error;
 			new_catalog = realloc(catalog, length);
 			if (!new_catalog)
 				goto out_error;
-- 
2.55.0