[PATCH] libsepol: Fix off-by-one error in cats_ebitmap_len

["Thiébaud Weksteen" <tweek@google.com>]

In cats_ebitmap_len(), i-1 was incorrectly used instead of i for looking up
category names at the end of a range. This resulted in an under-allocation
of the buffer for the CIL representation of category ranges, which causes
cats_ebitmap_to_str() to fail its safety check and return (null).

This fix correctly uses i (the current bit index) to look up the name for
the category at the end of the range.

Proof of Concept (PoC) Policy:
  class p sid kernel class p { f }
  sensitivity s0; dominance { s0 }
  category c0; category c1_very_long_category_name;
  level s0:c0.c1_very_long_category_name;
  mlsconstrain p { f } l1 == l2;
  type t; allow t self:p { f };
  role r; role r types { t };
  user u roles r level s0 range s0 - s0:c0.c1_very_long_category_name;
  sid kernel u:r:t:s0 - s0:c0.c1_very_long_category_name

Reproduction steps:
  1. checkpolicy -M -o poc.bin poc.conf
  2. checkpolicy -M -b -C -o poc.cil poc.bin
  3. cat poc.cil | grep userrange
     Before: (userrange u ((s0) (s0 (null))))
     After: (userrange u ((s0) (s0 (c0 c1_very_long_category_name))))

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
---
 libsepol/src/kernel_to_cil.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
index 06cf4498..49040ae4 100644
--- a/libsepol/src/kernel_to_cil.c
+++ b/libsepol/src/kernel_to_cil.c
@@ -1018,9 +1018,9 @@ static size_t cats_ebitmap_len(struct ebitmap *cats, char **val_to_name)
 
 		len += strlen(val_to_name[start]);
 		if (range > 2) {
-			len += strlen(val_to_name[i-1]) + strlen("(range  ) ");
+			len += strlen(val_to_name[i]) + strlen("(range  ) ");
 		} else if (range == 2) {
-			len += strlen(val_to_name[i-1]) + 2;
+			len += strlen(val_to_name[i]) + 2;
 		} else if (range == 1) {
 			len += 1;
 		}
-- 
2.53.0.1018.g2bb0e51243-goog