Re: [PATCH] libsepol: Check for zero when mapping identifier values

On Fri, Jul 31, 2026 at 1:51=E2=80=AFPM James Carter <[email protected]> wr=
ote:
>
> When expanding a base along with its modules, the identifier values
> of declarations are mapped from their values in the module to their
> values in the kernel policy. A maliciously crafted policy could
> create a situation where there is no mapping. This would leave the
> new identifier value as zero. Identifier values must start at 1
> because "value - 1" is used to reference zero-based arrays.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>