Re: [PATCH] libsepol/cil: fix size truncation in cil_add_file()

On Fri, Aug 7, 2026 at 8:44 AM Stephen Smalley
<[email protected]> wrote:
>
> On Thu, Aug 6, 2026 at 4:46 PM Vit Mojzis <[email protected]> wrote:
> >
> > cil_add_file() receives size as size_t but passes size + 2 to
> > cil_parser() which takes uint32_t. The existing overflow guard
> > (size > SIZE_MAX - 2) only prevents size_t wraparound but does
> > not catch truncation to 32 bits. Use UINT32_MAX - 2 as the limit
> > to match the downstream parameter type.
> >
> > Fixes:
> > 2. libsepol-3.11/cil/src/cil.c:561:2: cast_overflow: Truncation due to cast operation on "size + 2UL" from 64 to 32 bits.
> > 3. libsepol-3.11/cil/src/cil.c:561:2: overflow_sink: "size + 2UL", which might have overflowed, is passed to "cil_parser(name, buffer, size + 2UL, &db->parse)".
> > 4. libsepol-3.11/cil/src/cil_parser.c:247:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_lexer_setup".
> > 5. libsepol-3.11/cil/src/cil_lexer.l:71:2: var_assign_parm: Assigning: "size" = "size".
> > 6. libsepol-3.11/cil/src/cil_lexer.l:72:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_yy_scan_buffer".
> > 8. libsepol-3.11/cil/src/cil_lexer.c:1770:2: lower_bounds: Checking lower bounds of unsigned scalar "size" by taking the false branch of "size < 2UL".
> > 9. libsepol-3.11/cil/src/cil_lexer.c:1770:2: data_index: Using tainted expression "size - 2UL" as an index to pointer "base".
> >
> > Signed-off-by: Vit Mojzis <[email protected]>
>
> Acked-by: Stephen Smalley <[email protected]>

Thanks, merged.