Re: [PATCH] libsepol: Prevent OOB access of array when copying scope information

On Mon, Jul 20, 2026 at 8:20 AM Stephen Smalley
<[email protected]> wrote:
>
> On Fri, Jul 17, 2026 at 1:35 PM James Carter <[email protected]> wrote:
> >
> > The function copy_scope_index() in link.c copies information about
> > what declarations are in scope for the current block. This is tracked
> > in the "scope" field of the scope_index struct in an array of ebitmaps.
> > A second field called "class_perms_map" is used to track which
> > permissions are in scope for each class. The "class_perms_len" field is
> > the length of the permissions array. As the function is copying scoping
> > information from the module to the base policy, the index values are
> > translated as well. When the information for classes is translated and
> > copied the largest new index value for a class is determined. This value
> > is used to allocate the class_perms_map array. For each source class in
> > that array, the bits in the source ebitmap are translated and set in the
> > destination bitmap.
> >
> > A maliciously crafted policy could set permissions in the module's
> > class_perms_map for a class that is not in scope. If that class has
> > a new index that is greater than the largest index of a valid class,
> > then there will be an OOB write when copying the class_perms_map.
> >
> > When copying the class_perms_map, check that the index is not going to
> > result in an OOB write when converting. In addition, if there were no
> > classes, then just set class_perms_map to NULL and return. Also, don't
> > bother trying to copy permissions if the ebitmap is empty. Finally,
> > just use array notation when copying the scope and class_perms_map
> > data since they are both arrays of ebitmaps.
> >
> > Signed-off-by: James Carter <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Merged.