From 6e368dcac27eb3bedee87e5692377b2ba7d0e265 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 18 Aug 2026 20:42:02 +0200 Subject: [PATCH] libsepol- 3.11-2 - cil: fix size truncation in cil_add_file() Resolves: RHEL-212651 --- ...-fix-size-truncation-in-cil_add_file.patch | 44 +++++++++++++++++++ changelog | 3 ++ libsepol.spec | 3 +- 3 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 0001-libsepol-cil-fix-size-truncation-in-cil_add_file.patch diff --git a/0001-libsepol-cil-fix-size-truncation-in-cil_add_file.patch b/0001-libsepol-cil-fix-size-truncation-in-cil_add_file.patch new file mode 100644 index 0000000..e88127f --- /dev/null +++ b/0001-libsepol-cil-fix-size-truncation-in-cil_add_file.patch @@ -0,0 +1,44 @@ +From d3cea73bb031ed457d8f02d6c6a308621e0279c6 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 6 Aug 2026 22:42:13 +0200 +Subject: [PATCH] libsepol/cil: fix size truncation in cil_add_file() + +cil_add_file() receives size as size_t but passes size + 2 to +cil_parser() which takes uint32_t. The existing overflow guard +(size > SIZE_MAX - 2) only prevents size_t wraparound but does +not catch truncation to 32 bits. Use UINT32_MAX - 2 as the limit +to match the downstream parameter type. + +Fixes: +2. libsepol-3.11/cil/src/cil.c:561:2: cast_overflow: Truncation due to cast operation on "size + 2UL" from 64 to 32 bits. +3. libsepol-3.11/cil/src/cil.c:561:2: overflow_sink: "size + 2UL", which might have overflowed, is passed to "cil_parser(name, buffer, size + 2UL, &db->parse)". +4. libsepol-3.11/cil/src/cil_parser.c:247:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_lexer_setup". +5. libsepol-3.11/cil/src/cil_lexer.l:71:2: var_assign_parm: Assigning: "size" = "size". +6. libsepol-3.11/cil/src/cil_lexer.l:72:2: taint_sink_lv_call: Passing tainted expression "size" to taint sink "cil_yy_scan_buffer". +8. libsepol-3.11/cil/src/cil_lexer.c:1770:2: lower_bounds: Checking lower bounds of unsigned scalar "size" by taking the false branch of "size < 2UL". +9. libsepol-3.11/cil/src/cil_lexer.c:1770:2: data_index: Using tainted expression "size - 2UL" as an index to pointer "base". + +Signed-off-by: Vit Mojzis + +Co-Authored-By: Claude Opus 4.6 +Acked-by: Stephen Smalley +--- + libsepol/cil/src/cil.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libsepol/cil/src/cil.c b/libsepol/cil/src/cil.c +index 18b98fe2..d9a5a825 100644 +--- a/libsepol/cil/src/cil.c ++++ b/libsepol/cil/src/cil.c +@@ -549,7 +549,7 @@ int cil_add_file(cil_db_t *db, const char *name, const char *data, size_t size) + + cil_log(CIL_INFO, "Parsing %s\n", name); + +- if (size > SIZE_MAX - 2) { ++ if (size > UINT32_MAX - 2) { + cil_log(CIL_ERR, "File size is too large\n"); + return SEPOL_ERR; + } +-- +2.53.0 + diff --git a/changelog b/changelog index 8309365..706e895 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Tue Aug 18 2026 Vit Mojzis - 3.11-2 +- cil: fix size truncation in cil_add_file() (RHEL-212651) + * Wed Jul 01 2026 Petr Lautrbach - 3.11-1 - SELinux userspace 3.11 release diff --git a/libsepol.spec b/libsepol.spec index 8f70cbe..32468ab 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -1,7 +1,7 @@ Summary: SELinux binary policy manipulation library Name: libsepol Version: 3.11 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPL-2.1-or-later Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libsepol-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libsepol-%{version}.tar.gz.asc @@ -12,6 +12,7 @@ URL: https://github.com/SELinuxProject/selinux/wiki # $ git format-patch -N libsepol-3.11 -- libsepol # $ i=1; for j in 0*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done # Patch list start +Patch0001: 0001-libsepol-cil-fix-size-truncation-in-cil_add_file.patch # Patch list end BuildRequires: make BuildRequires: gcc