Commit 86c8db86 authored by Stephen Smalley's avatar Stephen Smalley Committed by Paul Moore
Browse files

selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len 



We should count the terminating NUL byte as part of the ctx_len.
Otherwise, UBSAN logs a warning:
  UBSAN: array-index-out-of-bounds in security/selinux/xfrm.c:99:14
  index 60 is out of range for type 'char [*]'

The allocation itself is correct so there is no actual out of bounds
indexing, just a warning.

Cc: stable@vger.kernel.org
Suggested-by: default avatarChristian Göttsche <cgzones@googlemail.com>
Link: https://lore.kernel.org/selinux/CAEjxPJ6tA5+LxsGfOJokzdPeRomBHjKLBVR6zbrg+_w3ZZbM3A@mail.gmail.com/


Signed-off-by: default avatarStephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent e04c78d8

security/selinux/xfrm.c

+1 −1
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ static int selinux_xfrm_alloc_user(struct xfrm_sec_ctx **ctxp, 


	ctx->ctx_doi = XFRM_SC_DOI_LSM;

	ctx->ctx_alg = XFRM_SC_ALG_SELINUX;

	ctx->ctx_len = str_len;

	ctx->ctx_len = str_len + 1;

	memcpy(ctx->ctx_str, &uctx[1], str_len);

	ctx->ctx_str[str_len] = '\0';

	rc = security_context_to_sid(ctx->ctx_str, str_len,