Re: [PATCH] checkpolicy/fuzz: ignore invalid policy versions for the Xen target

On Mon, Jul 27, 2026 at 3:18 PM Stephen Smalley
<[email protected]> wrote:
>
> Xen only supports specific policy versions (see policydb_compat[] in
> libsepol/src/policydb.c); the fuzzer will always fail on the
> policydb_write() call if given a version not listed in that array with
> a .target_platform of SEPOL_TARGET_XEN.
>
> Reported-by: oss-fuzz (issue 539336382)
> Signed-off-by: Stephen Smalley <[email protected]>

Merged.

> ---
>  checkpolicy/fuzz/checkpolicy-fuzzer.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/checkpolicy/fuzz/checkpolicy-fuzzer.c b/checkpolicy/fuzz/checkpolicy-fuzzer.c
> index 7db0d4c8..c58d10e9 100644
> --- a/checkpolicy/fuzz/checkpolicy-fuzzer.c
> +++ b/checkpolicy/fuzz/checkpolicy-fuzzer.c
> @@ -159,7 +159,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
>         /*
>          * Take the first byte whether to generate a SELinux or Xen policy,
>          * the second byte whether to parse as MLS policy,
> -        * and the second byte as policy version.
> +        * and the third byte as policy version.
>          */
>         if (size < 3)
>                 return 0;
> @@ -189,6 +189,10 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
>         if (policyvers < POLICYDB_VERSION_MIN ||
>             policyvers > POLICYDB_VERSION_MAX)
>                 return 0;
> +       if (platform == SEPOL_TARGET_XEN &&
> +           policyvers != POLICYDB_VERSION_XEN_DEVICETREE &&
> +           policyvers != POLICYDB_VERSION_BOUNDARY)
> +               return 0;
>         data += 3;
>         size -= 3;
>
> --
> 2.55.0
>