Re: [PATCH] libsepol/fuzz: Validate output of expand_module() before proceeding

On Mon, Aug 3, 2026 at 11:47=E2=80=AFAM James Carter <[email protected]> wr=
ote:
>
> When creating actual policies the output of expand_module() is
> written to disk. Converting that policy to CIL or performing other
> operations on it will require it to be read by policydb_read() which
> calls policydb_validate(). The fuzzer is not validating the policy,
> so it is reporting bugs that would be caught by validation.
>
> Have the fuzzer call policydb_validate() after expanding modules
> so it will not report bugs that are caught by validation.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
>  libsepol/fuzz/binpolicy-fuzzer.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/libsepol/fuzz/binpolicy-fuzzer.c b/libsepol/fuzz/binpolicy-f=
uzzer.c
> index 017f996e..f2379175 100644
> --- a/libsepol/fuzz/binpolicy-fuzzer.c
> +++ b/libsepol/fuzz/binpolicy-fuzzer.c
> @@ -88,6 +88,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t =
size)
>                                           /*check_assertions=3D*/0))
>                                 goto exit;
>
> +                       if (policydb_validate(NULL, &out))
> +                               goto exit;
> +
>                         (void)check_assertions(
>                                 NULL, &out, out.global->branch_list->avru=
les);
>                         (void)hierarchy_check_constraints(NULL, &out);
> --
> 2.55.0
>