Hide Forgot
Created attachment 1226256 [details] first input file found by AFL that crashed seinfo Description of problem: * found by American Fuzzy Lop * the /etc/selinux/minimum/policy/policy.30 file was used as input for fuzzing Version-Release number of selected component (if applicable): setools-debuginfo-3.3.8-1.1.el7.x86_64 setools-console-3.3.8-1.1.el7.x86_64 setools-libs-3.3.8-1.1.el7.x86_64 selinux-policy-minimum-3.13.1-102.el7.noarch selinux-policy-3.13.1-102.el7.noarch selinux-policy-targeted-3.13.1-102.el7.noarch How reproducible: * always Steps to Reproduce: # seinfo ./id000000 Statistics for policy file: ./id000000 Policy Version & Type: v.30 (binary, mls) Classes: 91 Permissions: 256 Sensitivities: 1 Categories: 1024 Types: 1599 Attributes: 157 Users: 6 Roles: 9 Booleans: 112 Cond. Expr.: 117 Allow: 20350 Neverallow: 0 Auditallow: 41 Dontaudit: 1934 Type_trans: 1621 Type_change: 21 Type_member: 13 Role allow: 25 Role_trans: 32 Range_trans: 88 Constraints: 109 Validatetrans: 0 Initial SIDs: 27 Fs_use: 28 Genfscon: 105 Portcon: 595 Netifcon: 0 Nodecon: 0 Segmentation fault # dmesg | grep -i segfault [ 5215.317909] seinfo[13399]: segfault at 0 ip 00007f82f8a78cfe sp 00007ffe67c50800 error 4 in libqpol.so.1.7[7f82f8a6b000+ca000] # Actual results: * segfault Expected results: * some error message but no segfault
# ls -l id000000 -rw-------. 1 root root 834610 Nov 30 06:12 id000000 # gdb seinfo ./id000000 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/bin/seinfo...Reading symbols from /usr/lib/debug/usr/bin/seinfo.debug...done. done. "/root/./id000000" is not a core dump: File format not recognized (gdb) r ./id000000 Starting program: /usr/bin/seinfo ./id000000 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Statistics for policy file: ./id000000 Policy Version & Type: v.30 (binary, mls) Classes: 91 Permissions: 256 Sensitivities: 1 Categories: 1024 Types: 1599 Attributes: 157 Users: 6 Roles: 9 Booleans: 112 Cond. Expr.: 117 Allow: 20350 Neverallow: 0 Auditallow: 41 Dontaudit: 1934 Type_trans: 1621 Type_change: 21 Type_member: 13 Role allow: 25 Role_trans: 32 Range_trans: 88 Constraints: 109 Validatetrans: 0 Initial SIDs: 27 Fs_use: 28 Genfscon: 105 Portcon: 595 Netifcon: 0 Nodecon: 0 Program received signal SIGSEGV, Segmentation fault. ebitmap_state_size (iter=<optimized out>) at iterator.c:403 403 ebitmap_for_each_bit(es->bmap, node, bit) { (gdb) bt #0 ebitmap_state_size (iter=<optimized out>) at iterator.c:403 #1 0x00007ffff7b1afd0 in qpol_iterator_get_size (iter=<optimized out>, size=size@entry=0x7fffffffe128) at iterator.c:523 #2 0x0000000000408c34 in print_stats (fp=0x7ffff7438400 <_IO_2_1_stdout_>, policydb=<optimized out>) at seinfo.c:402 #3 0x0000000000406acb in main (argc=<optimized out>, argv=0x7fffffffe408) at seinfo.c:1875 (gdb)
I don't think we are going to fix it unless it's a real example given that setools 3 no longer developed by upstream.
Created attachment 1226260 [details] bzip2 archive of input files causing a crash