[PATCH] libsepol: reject policies with no avtab entries in expand_module()

avtab_read() already rejects policies that have no avtab entries in
both libsepol and the kernel, but expand_module() can produce a
policydb that has none. Check and reject such policies in
expand_module() so that checkpolicy (and its fuzzer) will fail rather
than writing out an invalid binary policy.

Reported-by: oss-fuzz (issue 541553475)
Signed-off-by: Stephen Smalley <[email protected]>
---
 libsepol/src/expand.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 8cb62d82..466d5bc1 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -3494,6 +3494,11 @@ int expand_module(sepol_handle_t *handle, policydb_t *base, policydb_t *out,
 		goto cleanup;
 	}
 
+	if (out->te_avtab.nel == 0) {
+		ERR(handle, "avtab must contain at least one entry");
+		goto cleanup;
+	}
+
 	/* copy constraints */
 	if (hashtab_map(state.base->p_classes.table, constraint_copy_callback,
 			&state)) {
-- 
2.55.0