Re: [PATCH 1/2] libsepol: validate type datum value even for aliases

On Wed, Aug 5, 2026 at 10:44 AM Stephen Smalley
<[email protected]> wrote:
>
> Validate type datum values even for aliases. The corresponding change
> was already made in the kernel's type_index() function.
>
> Reported-by: Chen Gong <[email protected]>
> Signed-off-by: Stephen Smalley <[email protected]>

For these two patches:
Acked-by: James Carter <[email protected]>

> ---
>  libsepol/src/policydb.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
> index a42fdf98..44e26f4f 100644
> --- a/libsepol/src/policydb.c
> +++ b/libsepol/src/policydb.c
> @@ -1109,9 +1109,10 @@ static int type_index(hashtab_key_t key, hashtab_datum_t datum, void *datap)
>         typdatum = (type_datum_t *)datum;
>         p = (policydb_t *)datap;
>
> +       if (!value_isvalid(typdatum->s.value, p->p_types.nprim))
> +               return -EINVAL;
> +
>         if (typdatum->primary) {
> -               if (!value_isvalid(typdatum->s.value, p->p_types.nprim))
> -                       return -EINVAL;
>                 if (p->p_type_val_to_name[typdatum->s.value - 1] != NULL)
>                         return -EINVAL;
>                 p->p_type_val_to_name[typdatum->s.value - 1] = (char *)key;
> --
> 2.55.0
>