[patch] libselinux: fix type mismatch in string_to_security_class

[patch] libselinux: fix type mismatch in string_to_security_class

[Stephen Smalley]

Fix type mismatch in string_to_security_class, produces seg fault on x86_64.
For https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=249038

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>

---

 stringrep.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: src/stringrep.c
===================================================================
--- src/stringrep.c	(revision 2496)
+++ src/stringrep.c	(working copy)
@@ -236,7 +236,7 @@
 
 	dentry = readdir(dir);
 	while (dentry != NULL) {
-		size_t value;
+		unsigned int value;
 		struct stat m;
 
 		snprintf(path, sizeof path, "%s/class/%s/perms/%s", selinux_mnt,s,dentry->d_name);
@@ -258,7 +258,7 @@
 		if (ret < 0)
 			goto err4;
 
-		if (sscanf(buf, "%u", (unsigned int *)&value) != 1)
+		if (sscanf(buf, "%u", &value) != 1)
 			goto err4;
 
 		node->perms[value-1] = strdup(dentry->d_name);

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] libselinux: fix type mismatch in string_to_security_class

[Joshua Brindle]

Stephen Smalley wrote:
> Fix type mismatch in string_to_security_class, produces seg fault on x86_64.
> For https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=249038
>
> Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
>   
Acked-By: Joshua Brindle <method@manicmethod.com>

merged into libselinux 2.0.25
> ---
>
>  stringrep.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> Index: src/stringrep.c
>   
-p0 or -p1 from top of the repo? :)

> ===================================================================
> --- src/stringrep.c	(revision 2496)
> +++ src/stringrep.c	(working copy)
> @@ -236,7 +236,7 @@
>  
>  	dentry = readdir(dir);
>  	while (dentry != NULL) {
> -		size_t value;
> +		unsigned int value;
>  		struct stat m;
>  
>  		snprintf(path, sizeof path, "%s/class/%s/perms/%s", selinux_mnt,s,dentry->d_name);
> @@ -258,7 +258,7 @@
>  		if (ret < 0)
>  			goto err4;
>  
> -		if (sscanf(buf, "%u", (unsigned int *)&value) != 1)
> +		if (sscanf(buf, "%u", &value) != 1)
>  			goto err4;
>  
>  		node->perms[value-1] = strdup(dentry->d_name);
>
>   



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] libselinux: fix type mismatch in string_to_security_class

[John D. Ramsdell]

Stephen Smalley <sds@tycho.nsa.gov> writes:

> Fix type mismatch in string_to_security_class, produces seg fault on x86_64.
> For https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=249038

...
> -		size_t value;
> +		unsigned int value;
...
>  
> -		if (sscanf(buf, "%u", (unsigned int *)&value) != 1)
> +		if (sscanf(buf, "%u", &value) != 1)

There is another way to fix this bug.  You can leave the type as
size_t, but use the C99 z modifier.  GCC supports the z modifier.

> -		if (sscanf(buf, "%u", (unsigned int *)&value) != 1)
> +		if (sscanf(buf, "%zu", &value) != 1)

John

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [patch] libselinux: fix type mismatch in string_to_security_class

[Stephen Smalley]

On Tue, 2007-07-24 at 14:05 -0400, John D. Ramsdell wrote:
> Stephen Smalley <sds@tycho.nsa.gov> writes:
> 
> > Fix type mismatch in string_to_security_class, produces seg fault on x86_64.
> > For https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=249038
> 
> ...
> > -		size_t value;
> > +		unsigned int value;
> ...
> >  
> > -		if (sscanf(buf, "%u", (unsigned int *)&value) != 1)
> > +		if (sscanf(buf, "%u", &value) != 1)
> 
> There is another way to fix this bug.  You can leave the type as
> size_t, but use the C99 z modifier.  GCC supports the z modifier.

Sure, but the actual value is an unsigned int, not a size_t, so this is
the more correct fix.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.