[PATCH v2] libsepol/fuzz: Exercise module to CIL code when fuzzing

When fuzzing a kernel policy both sepol_kernel_policydb_to_conf()
and sepol_kernel_policydb_to_cil() are called to test those parts
of the code base. Call sepol_module_policydb_to_cil() for base and
module policies to test that part of the code base.

Signed-off-by: James Carter <[email protected]>
---
v2: Add include for module_to_cil.h
    Move the whole if statement for POLICY_BASE into the else block with
      the sepol_module_policydb_to_cil() call to make it clearer what is
      being done for kernel, base, and module policies.

 libsepol/fuzz/binpolicy-fuzzer.c | 39 ++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/libsepol/fuzz/binpolicy-fuzzer.c b/libsepol/fuzz/binpolicy-fuzzer.c
index c0d96d8f..017f996e 100644
--- a/libsepol/fuzz/binpolicy-fuzzer.c
+++ b/libsepol/fuzz/binpolicy-fuzzer.c
@@ -1,6 +1,7 @@
 #include <sepol/debug.h>
 #include <sepol/kernel_to_cil.h>
 #include <sepol/kernel_to_conf.h>
+#include <sepol/module_to_cil.h>
 #include <sepol/policydb/expand.h>
 #include <sepol/policydb/hierarchy.h>
 #include <sepol/policydb/link.h>
@@ -72,30 +73,34 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 
 		if (sepol_kernel_policydb_to_cil(devnull, &policydb))
 			abort();
+	} else {
+		if (sepol_module_policydb_to_cil(devnull, &policydb, 0))
+			abort();
 
-	} else if (policydb.policy_type == POLICY_BASE) {
-		if (link_modules(NULL, &policydb, NULL, 0, VERBOSE))
-			goto exit;
+		if (policydb.policy_type == POLICY_BASE) {
+			if (link_modules(NULL, &policydb, NULL, 0, VERBOSE))
+				goto exit;
 
-		if (policydb_init(&out))
-			goto exit;
+			if (policydb_init(&out))
+				goto exit;
 
-		if (expand_module(NULL, &policydb, &out, VERBOSE,
-				  /*check_assertions=*/0))
-			goto exit;
+			if (expand_module(NULL, &policydb, &out, VERBOSE,
+					  /*check_assertions=*/0))
+				goto exit;
 
-		(void)check_assertions(NULL, &out,
-				       out.global->branch_list->avrules);
-		(void)hierarchy_check_constraints(NULL, &out);
+			(void)check_assertions(
+				NULL, &out, out.global->branch_list->avrules);
+			(void)hierarchy_check_constraints(NULL, &out);
 
-		if (write_binary_policy(&out, devnull))
-			abort();
+			if (write_binary_policy(&out, devnull))
+				abort();
 
-		if (sepol_kernel_policydb_to_conf(devnull, &out))
-			abort();
+			if (sepol_kernel_policydb_to_conf(devnull, &out))
+				abort();
 
-		if (sepol_kernel_policydb_to_cil(devnull, &out))
-			abort();
+			if (sepol_kernel_policydb_to_cil(devnull, &out))
+				abort();
+		}
 	}
 
 exit:
-- 
2.55.0