Bug 1350806

Summary: /usr/libexec/selinux/hll/pp segfaults on base.pp
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: policycoreutilsAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Dalibor Pospíšil <dapospis>
Severity: high Docs Contact:
Priority: high    
Version: 7.3CC: dwalsh, lvrabec, mgrepl, mmalik, plautrba, ssekidde, vmojzis
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: policycoreutils-2.5-13.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1417200 (view as bug list) Environment:
Last Closed: 2017-08-01 16:16:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
first input file found by AFL that crashed hll/pp
none
second input file found by AFL that crashed hll/pp
none
first input file found by AFL that hanged hll/pp
none
bzip2 archive of input files causing a crash none

Description Milos Malik 2016-06-28 12:45:10 UTC
Description of problem:
* one of our automated TCs found following problem

Version-Release number of selected component (if applicable):
policycoreutils-newrole-2.5-3.el7.x86_64
policycoreutils-devel-2.5-3.el7.x86_64
policycoreutils-gui-2.5-3.el7.x86_64
policycoreutils-python-2.5-3.el7.x86_64
policycoreutils-sandbox-2.5-3.el7.x86_64
policycoreutils-2.5-3.el7.x86_64
selinux-policy-devel-3.13.1-82.el7.noarch
selinux-policy-targeted-3.13.1-82.el7.noarch
selinux-policy-3.13.1-82.el7.noarch
selinux-policy-minimum-3.13.1-82.el7.noarch
selinux-policy-doc-3.13.1-82.el7.noarch
selinux-policy-sandbox-3.13.1-82.el7.noarch
selinux-policy-mls-3.13.1-82.el7.noarch

How reproducible:
* always

Steps to Reproduce:
# rm -f input.pp*
# cp /etc/selinux/targeted/active/modules/100/base/hll input.pp.bz2
# bzip2 -d input.pp.bz2 
# /usr/libexec/selinux/hll/pp input.pp > output.cil 
# ls -l output.cil 
-rw-r--r--. 1 root root 1396764 Jun 28 14:41 output.cil
# /usr/libexec/selinux/hll/pp input.pp output.cil
Segmentation fault
# echo $?
139
# ls -l output.cil 
-rw-r--r--. 1 root root 0 Jun 28 14:42 output.cil
#

Actual results:
* segfault

Expected results:
* no segfaults

Comment 2 Milos Malik 2016-10-06 13:04:33 UTC
Created attachment 1207951 [details]
first input file found by AFL that crashed hll/pp

Comment 3 Milos Malik 2016-10-06 13:05:15 UTC
Created attachment 1207952 [details]
second input file found by AFL that crashed hll/pp

Comment 4 Milos Malik 2016-10-06 13:06:05 UTC
Created attachment 1207953 [details]
first input file found by AFL that hanged hll/pp

Comment 5 Milos Malik 2016-10-07 16:35:42 UTC
Created attachment 1208200 [details]
bzip2 archive of input files causing a crash

# rpm -qa libsepol\* libsemanage\* libselinux\* policycoreutils\* selinux-policy\* | sort
libselinux-2.5-6.el7.x86_64
libselinux-debuginfo-2.5-6.el7.x86_64
libselinux-devel-2.5-6.el7.x86_64
libselinux-python-2.5-6.el7.x86_64
libselinux-ruby-2.5-6.el7.x86_64
libselinux-utils-2.5-6.el7.x86_64
libsemanage-2.5-4.el7.x86_64
libsemanage-devel-2.5-4.el7.x86_64
libsemanage-python-2.5-4.el7.x86_64
libsemanage-static-2.5-4.el7.x86_64
libsepol-2.5-6.el7.x86_64
libsepol-debuginfo-2.5-6.el7.x86_64
libsepol-devel-2.5-6.el7.x86_64
libsepol-static-2.5-6.el7.x86_64
policycoreutils-2.5-9.el7.x86_64
policycoreutils-debuginfo-2.5-9.el7.x86_64
policycoreutils-devel-2.5-9.el7.x86_64
policycoreutils-gui-2.5-9.el7.x86_64
policycoreutils-newrole-2.5-9.el7.x86_64
policycoreutils-python-2.5-9.el7.x86_64
policycoreutils-sandbox-2.5-9.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
selinux-policy-devel-3.13.1-102.el7.noarch
selinux-policy-doc-3.13.1-102.el7.noarch
selinux-policy-minimum-3.13.1-102.el7.noarch
selinux-policy-mls-3.13.1-102.el7.noarch
selinux-policy-sandbox-3.13.1-102.el7.noarch
selinux-policy-targeted-3.13.1-102.el7.noarch
#

Comment 12 errata-xmlrpc 2017-08-01 16:16:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1883