Re: [PATCH] libsepol/cil: fix size truncation in cil_add_file()

On Thu, Aug 6, 2026 at 4:46 PM Vit Mojzis <[email protected]> wrote:
>
> cil_add_file() receives size as size_t but passes size + 2 to
> cil_parser() which takes uint32_t. The existing overflow guard
> (size > SIZE_MAX - 2) only prevents size_t wraparound but does
> not catch truncation to 32 bits. Use UINT32_MAX - 2 as the limit
> to match the downstream parameter type.
>
> Fixes:
> 2. libsepol-3.11/cil/src/cil.c:561:2: cast_overflow: Truncation due to cast operation on "size + 2UL" from 64 to 32 bits.
> 3. libsepol-3.11/cil/src/cil.c:561:2: overflow_sink: "size + 2UL", which might have overflowed, is passed to "cil_parser(name, buffer, size + 2UL, &db->parse)".
> 4. libsepol-3.11/cil/src/cil_parser.c:247:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_lexer_setup".
> 5. libsepol-3.11/cil/src/cil_lexer.l:71:2: var_assign_parm: Assigning: "size" = "size".
> 6. libsepol-3.11/cil/src/cil_lexer.l:72:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_yy_scan_buffer".
> 8. libsepol-3.11/cil/src/cil_lexer.c:1770:2: lower_bounds: Checking lower bounds of unsigned scalar "size" by taking the false branch of "size < 2UL".
> 9. libsepol-3.11/cil/src/cil_lexer.c:1770:2: data_index: Using tainted expression "size - 2UL" as an index to pointer "base".
>
> Signed-off-by: Vit Mojzis <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> Co-Authored-By: Claude Opus 4.6 <[email protected]>
> ---
>
> Not sure if this could be a genuine issue as the parser is not likely to
> encounter a 4GiB file.
>
>  libsepol/cil/src/cil.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c
> index 18b98fe2..d9a5a825 100644
> --- a/libsepol/cil/src/cil.c
> +++ b/libsepol/cil/src/cil.c
> @@ -549,7 +549,7 @@ int cil_add_file(cil_db_t *db, const char *name, const char *data, size_t size)
>
>         cil_log(CIL_INFO, "Parsing %s\n", name);
>
> -       if (size > SIZE_MAX - 2) {
> +       if (size > UINT32_MAX - 2) {
>                 cil_log(CIL_ERR, "File size is too large\n");
>                 return SEPOL_ERR;
>         }
> --
> 2.53.0
>
>