[PATCH] libselinux: avcstat: reject out-of-range interval values

[PATCH] libselinux: avcstat: reject out-of-range interval values

[Evgeniy Gorbanyov]

strtoul() returns unsigned long, but avcstat stored the result in a
signed int and passed it to sleep(). A value above INT_MAX becomes
negative, and sleep() then treats it as a large unsigned duration.
Compare the full strtoul() result with INT_MAX before narrowing it.

Signed-off-by: Evgeniy Gorbanyov <esgor@altlinux.org>
---
 libselinux/utils/avcstat.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libselinux/utils/avcstat.c b/libselinux/utils/avcstat.c
index 640a7a05..0c534f51 100644
--- a/libselinux/utils/avcstat.c
+++ b/libselinux/utils/avcstat.c
@@ -13,6 +13,7 @@
 #include <libgen.h>
 #include <stdarg.h>
 #include <errno.h>
+#include <limits.h>
 #include <string.h>
 #include <fcntl.h>
 #include <unistd.h>
@@ -122,9 +123,9 @@ int main(int argc, char **argv)
 
 	if (optind < argc) {
 		char *arg = argv[optind];
-		unsigned int n = strtoul(arg, NULL, 10);
+		unsigned long n = strtoul(arg, NULL, 10);
 
-		if (errno == ERANGE) {
+		if (errno == ERANGE || n > INT_MAX) {
 			usage();
 			die("invalid interval \'%s\'", arg);
 		}
-- 
2.50.1

Re: [PATCH] libselinux: avcstat: reject out-of-range interval values

[Stephen Smalley]

On Thu, Oct 8, 2026 at 3:33 AM Evgeniy Gorbanyov <esgor@altlinux.org> wrote:
>
> strtoul() returns unsigned long, but avcstat stored the result in a
> signed int and passed it to sleep(). A value above INT_MAX becomes
> negative, and sleep() then treats it as a large unsigned duration.
> Compare the full strtoul() result with INT_MAX before narrowing it.
>
> Signed-off-by: Evgeniy Gorbanyov <esgor@altlinux.org>
> ---
>  libselinux/utils/avcstat.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/libselinux/utils/avcstat.c b/libselinux/utils/avcstat.c
> index 640a7a05..0c534f51 100644
> --- a/libselinux/utils/avcstat.c
> +++ b/libselinux/utils/avcstat.c
> @@ -13,6 +13,7 @@
>  #include <libgen.h>
>  #include <stdarg.h>
>  #include <errno.h>
> +#include <limits.h>
>  #include <string.h>
>  #include <fcntl.h>
>  #include <unistd.h>
> @@ -122,9 +123,9 @@ int main(int argc, char **argv)
>
>         if (optind < argc) {
>                 char *arg = argv[optind];
> -               unsigned int n = strtoul(arg, NULL, 10);
> +               unsigned long n = strtoul(arg, NULL, 10);
>
> -               if (errno == ERANGE) {
> +               if (errno == ERANGE || n > INT_MAX) {

Since you are touching this: errno is checked for ERANGE but never
cleared before the strtoul() call so a stale ERANGE from earlier would
reject a valid interval. Pre-existing and probably not reachable with
the current call sequence, but addin errno = 0; before strtoul() would
make the check future-proof. Up to you whether you fold it in and or
leave it for a follow-up.

Otherwise,
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>

>                         usage();
>                         die("invalid interval \'%s\'", arg);
>                 }
> --
> 2.50.1
>
>

[PATCH v2] libselinux: avcstat: reject out-of-range interval values

[Evgeniy Gorbanyov]

strtoul() returns unsigned long, but avcstat stored the result in a
signed int and passed it to sleep(). A value above INT_MAX becomes
negative, and sleep() then treats it as a large unsigned duration.
Compare the full strtoul() result with INT_MAX before narrowing it.

Clear errno before strtoul() so a stale ERANGE cannot reject a valid
interval.

Signed-off-by: Evgeniy Gorbanyov <esgor@altlinux.org>
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 libselinux/utils/avcstat.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libselinux/utils/avcstat.c b/libselinux/utils/avcstat.c
index 640a7a05..c7658792 100644
--- a/libselinux/utils/avcstat.c
+++ b/libselinux/utils/avcstat.c
@@ -13,6 +13,7 @@
 #include <libgen.h>
 #include <stdarg.h>
 #include <errno.h>
+#include <limits.h>
 #include <string.h>
 #include <fcntl.h>
 #include <unistd.h>
@@ -122,9 +123,12 @@ int main(int argc, char **argv)
 
 	if (optind < argc) {
 		char *arg = argv[optind];
-		unsigned int n = strtoul(arg, NULL, 10);
+		unsigned long n;
 
-		if (errno == ERANGE) {
+		errno = 0;
+		n = strtoul(arg, NULL, 10);
+
+		if (errno == ERANGE || n > INT_MAX) {
 			usage();
 			die("invalid interval \'%s\'", arg);
 		}
-- 
2.50.1

Re: [PATCH v2] libselinux: avcstat: reject out-of-range interval values

[Stephen Smalley]

On Fri, Oct 9, 2026 at 1:57 AM Evgeniy Gorbanyov <esgor@altlinux.org> wrote:
>
> strtoul() returns unsigned long, but avcstat stored the result in a
> signed int and passed it to sleep(). A value above INT_MAX becomes
> negative, and sleep() then treats it as a large unsigned duration.
> Compare the full strtoul() result with INT_MAX before narrowing it.
>
> Clear errno before strtoul() so a stale ERANGE cannot reject a valid
> interval.
>
> Signed-off-by: Evgeniy Gorbanyov <esgor@altlinux.org>
> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Thanks, merged.