[PATCH] libsepol: log an error if we hit the max depth for __evaluate_classperms_list()

Add a cil_log() statement so that we do not fail silently if we hit
the max depth. While we are here, introduce a #define for the max
depth and use it, and fix the comparison so that we fail immediately
when the depth has already reached the limit.

Signed-off-by: Stephen Smalley <[email protected]>
---
 libsepol/cil/src/cil_post.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libsepol/cil/src/cil_post.c b/libsepol/cil/src/cil_post.c
index 183b0d49..35c14fae 100644
--- a/libsepol/cil/src/cil_post.c
+++ b/libsepol/cil/src/cil_post.c
@@ -49,6 +49,8 @@
 #include "cil_symtab.h"
 #include "cil_deny.h"
 
+#define MAX_CLASSPERMS_DEPTH (32)
+
 #define GEN_REQUIRE_ATTR \
 	"cil_gen_require" /* Also in libsepol/src/module_to_cil.c */
 #define TYPEATTR_INFIX "_typeattr_" /* Also in libsepol/src/module_to_cil.c */
@@ -2296,8 +2298,11 @@ static int __evaluate_classperms_list(struct cil_list *classperms,
 	int rc = SEPOL_ERR;
 	struct cil_list_item *curr;
 
-	if (depth > 32)
+	if (depth >= MAX_CLASSPERMS_DEPTH) {
+		cil_log(CIL_ERR, "Exceeded max classperms depth (%u)",
+			MAX_CLASSPERMS_DEPTH);
 		return SEPOL_ERR;
+	}
 
 	cil_list_for_each(curr, classperms) {
 		if (curr->flavor == CIL_CLASSPERMS) {
-- 
2.55.0