Bug 1382769 - semodule_deps segfaults on certain inputs
Summary: semodule_deps segfaults on certain inputs
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: policycoreutils
Version: 7.3
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-07 16:21 UTC by Milos Malik
Modified: 2017-06-29 13:42 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1382760
: 1383808 (view as bug list)
Environment:
Last Closed: 2017-06-29 13:42:27 UTC
Target Upstream Version:


Attachments (Terms of Use)
bzip2 archive of input files causing a crash (125.25 KB, application/x-bzip)
2016-10-07 16:21 UTC, Milos Malik
no flags Details

Description Milos Malik 2016-10-07 16:21:10 UTC
Created attachment 1208189 [details]
bzip2 archive of input files causing a crash

Description of problem:
* found by American Fuzzy Lop

Version-Release number of selected component (if applicable):
libselinux-2.5-6.el7.x86_64
libselinux-debuginfo-2.5-6.el7.x86_64
libselinux-devel-2.5-6.el7.x86_64
libselinux-python-2.5-6.el7.x86_64
libselinux-ruby-2.5-6.el7.x86_64
libselinux-utils-2.5-6.el7.x86_64
libsemanage-2.5-4.el7.x86_64
libsemanage-devel-2.5-4.el7.x86_64
libsemanage-python-2.5-4.el7.x86_64
libsemanage-static-2.5-4.el7.x86_64
libsepol-2.5-6.el7.x86_64
libsepol-debuginfo-2.5-6.el7.x86_64
libsepol-devel-2.5-6.el7.x86_64
libsepol-static-2.5-6.el7.x86_64
policycoreutils-2.5-9.el7.x86_64
policycoreutils-debuginfo-2.5-9.el7.x86_64
policycoreutils-devel-2.5-9.el7.x86_64
policycoreutils-gui-2.5-9.el7.x86_64
policycoreutils-newrole-2.5-9.el7.x86_64
policycoreutils-python-2.5-9.el7.x86_64
policycoreutils-sandbox-2.5-9.el7.x86_64
selinux-policy-3.13.1-102.el7.noarch
selinux-policy-devel-3.13.1-102.el7.noarch
selinux-policy-doc-3.13.1-102.el7.noarch
selinux-policy-minimum-3.13.1-102.el7.noarch
selinux-policy-mls-3.13.1-102.el7.noarch
selinux-policy-sandbox-3.13.1-102.el7.noarch
selinux-policy-targeted-3.13.1-102.el7.noarch

How reproducible:
* always

Steps to Reproduce:
# tar jxf crashes.tar.bz2 
# ls -l semodule_deps
total 3752
-rw-r--r--. 1 root root   64540 Oct  7 18:14 empty.pp
-rw-------. 1 root root 1888053 Oct  7 18:11 id000000
-rw-------. 1 root root 1888053 Oct  7 18:11 id000001
# semodule_deps semodule_deps/id000001 semodule_deps/empty.pp 
Segmentation fault
# dmesg | tail -n 1
[27297.554439] semodule_deps[12424]: segfault at 0 ip 00007ffa323b3474 sp 00007ffe45d7ac30 error 4 in semodule_deps[7ffa32395000+39000]
# semodule_deps semodule_deps/id000000 semodule_deps/empty.pp 
libsepol.ebitmap_set_bit: bitmap overflow, bit 0xffffffff
libsepol.copy_scope_index: Out of memory!
*** Error in `semodule_deps': double free or corruption (out): 0x00007f3dd7587020 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7c503)[0x7f3dd51bf503]
semodule_deps(+0x1754c)[0x7f3dd573d54c]
semodule_deps(+0x17572)[0x7f3dd573d572]
semodule_deps(+0x175cf)[0x7f3dd573d5cf]
semodule_deps(+0x153d2)[0x7f3dd573b3d2]
semodule_deps(+0x1555f)[0x7f3dd573b55f]
semodule_deps(+0x1559c)[0x7f3dd573b59c]
semodule_deps(+0x28544)[0x7f3dd574e544]
semodule_deps(+0x37d8)[0x7f3dd57297d8]
semodule_deps(+0x1e84)[0x7f3dd5727e84]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f3dd5164b35]
semodule_deps(+0x24f9)[0x7f3dd57284f9]
======= Memory map: ========
7f3dd0000000-7f3dd0021000 rw-p 00000000 00:00 0 
7f3dd0021000-7f3dd4000000 ---p 00000000 00:00 0 
7f3dd4f2d000-7f3dd4f42000 r-xp 00000000 fd:02 37469376                   /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f3dd4f42000-7f3dd5141000 ---p 00015000 fd:02 37469376                   /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f3dd5141000-7f3dd5142000 r--p 00014000 fd:02 37469376                   /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f3dd5142000-7f3dd5143000 rw-p 00015000 fd:02 37469376                   /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f3dd5143000-7f3dd52f9000 r-xp 00000000 fd:02 33722321                   /usr/lib64/libc-2.17.so
7f3dd52f9000-7f3dd54f9000 ---p 001b6000 fd:02 33722321                   /usr/lib64/libc-2.17.so
7f3dd54f9000-7f3dd54fd000 r--p 001b6000 fd:02 33722321                   /usr/lib64/libc-2.17.so
7f3dd54fd000-7f3dd54ff000 rw-p 001ba000 fd:02 33722321                   /usr/lib64/libc-2.17.so
7f3dd54ff000-7f3dd5504000 rw-p 00000000 00:00 0 
7f3dd5504000-7f3dd5524000 r-xp 00000000 fd:02 33640401                   /usr/lib64/ld-2.17.so
7f3dd56f7000-7f3dd56fa000 rw-p 00000000 00:00 0 
7f3dd5721000-7f3dd5723000 rw-p 00000000 00:00 0 
7f3dd5723000-7f3dd5724000 r--p 0001f000 fd:02 33640401                   /usr/lib64/ld-2.17.so
7f3dd5724000-7f3dd5725000 rw-p 00020000 fd:02 33640401                   /usr/lib64/ld-2.17.so
7f3dd5725000-7f3dd5726000 rw-p 00000000 00:00 0 
7f3dd5726000-7f3dd575f000 r-xp 00000000 fd:02 17125891                   /usr/bin/semodule_deps
7f3dd595f000-7f3dd5960000 r--p 00039000 fd:02 17125891                   /usr/bin/semodule_deps
7f3dd5960000-7f3dd5961000 rw-p 0003a000 fd:02 17125891                   /usr/bin/semodule_deps
7f3dd5961000-7f3dd5962000 rw-p 00000000 00:00 0 
7f3dd7086000-7f3dd758d000 rw-p 00000000 00:00 0                          [heap]
7ffdc6aa4000-7ffdc6ac5000 rw-p 00000000 00:00 0                          [stack]
7ffdc6b0c000-7ffdc6b0e000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted
#

Actual results:
* segfaults

Expected results:
* some error message but no segfault


Note You need to log in before you can comment on or make changes to this bug.