Re: [PATCH] selinux: conditional expression type validation was off-by-one

[Joshua Brindle <method@manicmethod.com>]

Vesa-Matti J Kari wrote:
> This is the same off-by-one bug that was already fixed in the kernel.
> (According to my understanding neither of these bugs has security
> implications)
> 
> Signed-off-by: Vesa-Matti Kari <vmkari@cc.helsinki.fi>
> ---
> 
>  include/sepol/policydb/conditional.h |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> Index: libsepol/include/sepol/policydb/conditional.h
> ===================================================================
> --- libsepol/include/sepol/policydb/conditional.h	(revision 2950)
> +++ libsepol/include/sepol/policydb/conditional.h	(working copy)
> @@ -48,7 +48,7 @@
>  #define COND_XOR	5	/* bool ^ bool */
>  #define COND_EQ		6	/* bool == bool */
>  #define COND_NEQ	7	/* bool != bool */
> -#define COND_LAST	8
> +#define COND_LAST	COND_NEQ
>  	uint32_t expr_type;
>  	uint32_t bool;
>  	struct cond_expr *next;
> 

Acked-by: Joshua Brindle <method@manicmethod.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.