[PATCH] libsepol: Fix potential NULL dereference in policydb_read()

[PATCH] libsepol: Fix potential NULL dereference in policydb_read()

[James Carter]

Since there can be gaps in the type_val_to_struct array for very
old policies (version < POLICYDB_VERSION_BOUNDARY), need to
that it is not NULL for a particular index before using.

Reported-by: oss-fuzz (issue 474424148)
Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/policydb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
index 6aaa18f2..9760b164 100644
--- a/libsepol/src/policydb.c
+++ b/libsepol/src/policydb.c
@@ -4513,7 +4513,7 @@ int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
 					if (j >= p->p_types.nprim)
 						goto bad;
 
-					if (p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) {
+					if (p->type_val_to_struct[i] && p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) {
 						ERR(fp->handle, "Invalid to have type attributes associated with an attribute for a kernel policy");
 						goto bad;
 					}
-- 
2.52.0

Re: [PATCH] libsepol: Fix potential NULL dereference in policydb_read()

[Jason Zaman]

On Thu, Jan 22, 2026 at 11:45:45AM -0500, James Carter wrote:
> Since there can be gaps in the type_val_to_struct array for very
> old policies (version < POLICYDB_VERSION_BOUNDARY), need to
> that it is not NULL for a particular index before using.
> 
> Reported-by: oss-fuzz (issue 474424148)
> Signed-off-by: James Carter <jwcart2@gmail.com>
Signed-off-by: Jason Zaman <jason@perfinion.com>

Thanks, applied.
> ---
>  libsepol/src/policydb.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libsepol/src/policydb.c b/libsepol/src/policydb.c
> index 6aaa18f2..9760b164 100644
> --- a/libsepol/src/policydb.c
> +++ b/libsepol/src/policydb.c
> @@ -4513,7 +4513,7 @@ int policydb_read(policydb_t * p, struct policy_file *fp, unsigned verbose)
>  					if (j >= p->p_types.nprim)
>  						goto bad;
>  
> -					if (p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) {
> +					if (p->type_val_to_struct[i] && p->type_val_to_struct[i]->flavor == TYPE_ATTRIB) {
>  						ERR(fp->handle, "Invalid to have type attributes associated with an attribute for a kernel policy");
>  						goto bad;
>  					}
> -- 
> 2.52.0
> 
>