From c659696964a7530ddd9ae075919b44f263fba05c Mon Sep 17 00:00:00 2001 From: John Johansen Date: Sat, 31 Aug 2019 15:55:06 -0700 Subject: apparmor: add a valid state flags check Add a check to ensure only known state flags are set on each state in the dfa. Signed-off-by: John Johansen --- security/apparmor/match.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'security/apparmor/match.c') diff --git a/security/apparmor/match.c b/security/apparmor/match.c index 525ce22dc0e9..b477352305ed 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c @@ -202,6 +202,10 @@ static int verify_dfa(struct aa_dfa *dfa) if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) && (DEFAULT_TABLE(dfa)[i] >= state_count)) goto out; + if (BASE_TABLE(dfa)[i] & MATCH_FLAGS_INVALID) { + pr_err("AppArmor DFA state with invalid match flags"); + goto out; + } if (base_idx(BASE_TABLE(dfa)[i]) + 255 >= trans_count) { pr_err("AppArmor DFA next/check upper bounds error\n"); goto out; -- cgit v1.2.3