Re: [PATCH] policycoreutils/secon: ensure that range_bg is not left NULL

On Fri, Jul 17, 2026 at 1:27 PM Stephen Smalley
<[email protected]> wrote:
>
> The color string from mcstransd is split into eight tokens; every
> strtok()-result is NULL-checked except the last, so a truncated color
> string leaves colors.range_bg NULL and disp_color_to_ansi()
> dereferences it. Check it and handle the same way as the others.
>
> Signed-off-by: Stephen Smalley <[email protected]>

Merged.

> ---
>  policycoreutils/secon/secon.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/policycoreutils/secon/secon.c b/policycoreutils/secon/secon.c
> index 48daf9d5..5cc3d943 100644
> --- a/policycoreutils/secon/secon.c
> +++ b/policycoreutils/secon/secon.c
> @@ -696,6 +696,8 @@ static void disp_con(const char *scon_raw)
>                 if (!color.range_fg)
>                         errx(EXIT_FAILURE, "Invalid color string");
>                 color.range_bg = strtok(NULL, " ");
> +               if (!color.range_bg)
> +                       errx(EXIT_FAILURE, "Invalid color string");
>
>                 color.valid = 1;
>         }
> --
> 2.55.0
>