Re: [PATCH 1/5] libselinux: selinux_set_mapping(): reject class tables with too many classes

On Wed, Jul 15, 2026 at 2:49 PM Stephen Smalley
<[email protected]> wrote:
>
> Prevent integer overflow while counting the caller-supplied class
> table and return an error if the table has more classes than
> security_class_t permits.
>
> Signed-off-by: Stephen Smalley <[email protected]>

This series has been merged.

> ---
>  libselinux/src/mapping.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/libselinux/src/mapping.c b/libselinux/src/mapping.c
> index ddc11dae..1fd1f04d 100644
> --- a/libselinux/src/mapping.c
> +++ b/libselinux/src/mapping.c
> @@ -3,6 +3,7 @@
>   */
>
>  #include <errno.h>
> +#include <limits.h>
>  #include <stdio.h>
>  #include <stdlib.h>
>  #include <stdarg.h>
> @@ -35,8 +36,7 @@ static security_class_t current_mapping_size = 0;
>  int selinux_set_mapping(const struct security_class_mapping *map)
>  {
>         size_t size = sizeof(struct selinux_mapping);
> -       security_class_t i, j;
> -       unsigned k;
> +       unsigned int i, j, k;
>         bool print_unknown_handle = false;
>         bool reject = (security_reject_unknown() == 1);
>         bool deny = (security_deny_unknown() == 1);
> @@ -56,6 +56,10 @@ int selinux_set_mapping(const struct security_class_mapping *map)
>         i = 0;
>         while (map[i].name)
>                 i++;
> +       if (i >= USHRT_MAX) {
> +               errno = EINVAL;
> +               goto err;
> +       }
>
>         /* Allocate space for the class records, plus one for class zero */
>         current_mapping = (struct selinux_mapping *)calloc(++i, size);
> --
> 2.55.0
>