[PATCH] libsepol: Non-mls polcies should not have any levels

A maliciously crafted non-mls policy could still have levels in it.
There is no validation of levels for a non-mls policy which could
cause a problem if those levels are processed somewhere in libsepol.

A non-mls policy should have no entries in the level symbol table,
so check that the symbol table is empty when validating and return
an error if it is not.

Signed-off-by: James Carter <[email protected]>
---
 libsepol/src/policydb_validate.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/policydb_validate.c b/libsepol/src/policydb_validate.c
index fc66a4c7..fa36950e 100644
--- a/libsepol/src/policydb_validate.c
+++ b/libsepol/src/policydb_validate.c
@@ -1024,9 +1024,14 @@ static int validate_datum_array_entries(sepol_handle_t *handle,
 			&margs))
 		goto bad;
 
-	if (p->mls && hashtab_map(symtabs[SYM_LEVELS].table,
+	if (p->mls) {
+		if (hashtab_map(symtabs[SYM_LEVELS].table,
 				  validate_level_datum_wrapper, &margs))
-		goto bad;
+			goto bad;
+	} else {
+		if (symtabs[SYM_LEVELS].table->nel != 0)
+			goto bad;
+	}
 
 	if (hashtab_map(symtabs[SYM_CATS].table, validate_datum,
 			&flavors[SYM_CATS]))
-- 
2.55.0