[PATCH] libsepol/fuzz: Validate output of expand_module() before proceeding

When creating actual policies the output of expand_module() is
written to disk. Converting that policy to CIL or performing other
operations on it will require it to be read by policydb_read() which
calls policydb_validate(). The fuzzer is not validating the policy,
so it is reporting bugs that would be caught by validation.

Have the fuzzer call policydb_validate() after expanding modules
so it will not report bugs that are caught by validation.

Signed-off-by: James Carter <[email protected]>
---
 libsepol/fuzz/binpolicy-fuzzer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libsepol/fuzz/binpolicy-fuzzer.c b/libsepol/fuzz/binpolicy-fuzzer.c
index 017f996e..f2379175 100644
--- a/libsepol/fuzz/binpolicy-fuzzer.c
+++ b/libsepol/fuzz/binpolicy-fuzzer.c
@@ -88,6 +88,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 					  /*check_assertions=*/0))
 				goto exit;
 
+			if (policydb_validate(NULL, &out))
+				goto exit;
+
 			(void)check_assertions(
 				NULL, &out, out.global->branch_list->avrules);
 			(void)hierarchy_check_constraints(NULL, &out);
-- 
2.55.0