Re: [PATCH v2] checkpolicy-fuzzer: drop invalid assertion

On Thu, Aug 6, 2026 at 10:15 AM Stephen Smalley
<[email protected]> wrote:
>
> The checkpolicy-fuzzer has an invalid assertion; checkpolicy
> intentionally tracks errors via policydb_errors and does not always
> return non-zero from yyparse() if there were any errors during the
> compilation.
>
> Reported-by: oss-fuzz (issue 471491765)
> Signed-off-by: Stephen Smalley <[email protected]>

Acked-by: James Carter <[email protected]>

> ---
> v2 removes both asserts.
>
>  checkpolicy/fuzz/checkpolicy-fuzzer.c | 3 ---
>  1 file changed, 3 deletions(-)
>
> diff --git a/checkpolicy/fuzz/checkpolicy-fuzzer.c b/checkpolicy/fuzz/checkpolicy-fuzzer.c
> index c58d10e9..401f24e3 100644
> --- a/checkpolicy/fuzz/checkpolicy-fuzzer.c
> +++ b/checkpolicy/fuzz/checkpolicy-fuzzer.c
> @@ -106,8 +106,6 @@ static int read_source_policy(policydb_t *p, const uint8_t *data, size_t size)
>         }
>
>         rc = yyparse();
> -       // TODO: drop global variable policydb_errors if proven to be redundant
> -       assert(rc || !policydb_errors);
>         if (rc || policydb_errors) {
>                 queue_destroy(id_queue);
>                 fclose(yyin);
> @@ -120,7 +118,6 @@ static int read_source_policy(policydb_t *p, const uint8_t *data, size_t size)
>         yyrestart(yyin);
>
>         rc = yyparse();
> -       assert(rc || !policydb_errors);
>         if (rc || policydb_errors) {
>                 queue_destroy(id_queue);
>                 fclose(yyin);
> --
> 2.55.0
>