Re: [PATCH] libsemanage: user_base_parse: prevent OOB read on truncated config

On Wed, Jul 15, 2026 at 12:58 PM Stephen Smalley
<[email protected]> wrote:
>
> If the configuration file happens to be truncated after the role name
> on the last line with no trailing newline, semicolon, or closing
> bracket, user_base_parse() will incorrectly advance the pointer beyond
> the end of the buffer and dereference it. Only advance the pointer
> when a delimiter is actually consumed.
>
> Signed-off-by: Stephen Smalley <[email protected]>

Merged.

> ---
>  libsemanage/src/users_base_file.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/libsemanage/src/users_base_file.c b/libsemanage/src/users_base_file.c
> index 4aa2266b..05904b3e 100644
> --- a/libsemanage/src/users_base_file.c
> +++ b/libsemanage/src/users_base_file.c
> @@ -115,7 +115,8 @@ static int user_base_parse(semanage_handle_t *handle, parse_info_t *info,
>                         info->ptr++;
>
>                 delim = *(info->ptr);
> -               *(info->ptr)++ = '\0';
> +               if (delim)
> +                       *(info->ptr)++ = '\0';
>
>                 if (semanage_user_base_add_role(handle, user, start) < 0)
>                         goto err;
> --
> 2.55.0
>