Re: [PATCH] libsepol: Fix potential use of an uninitialized value in link.c

[Jason Zaman <jason@perfinion.com>]

On Thu, Jan 22, 2026 at 01:52:43PM -0500, James Carter wrote:
> The fields in struct missing_requirement are not assigned a value
> in the case where a class is required but not in scope for an
> optional block. This results in the use of an uninitialized value
> in  print_missing_requirements(). The fields of the struct are
> assigned correctly when the permission of a class is not in scope.
> 
> Assign values to the fields of the struct missing_requirement when
> exiting early because the class is not in scope. Use 0 for the
> permission index and only print the class name in
> print_missing_requirements() if the permission index is 0.
> 
> Reported-by: oss-fuzz (issue 472084713)
> Signed-off-by: James Carter <jwcart2@gmail.com>
Signed-off-by: Jason Zaman <jason@perfinion.com>

Thanks, applied.
> ---
>  libsepol/src/link.c | 27 ++++++++++++++++-----------
>  1 file changed, 16 insertions(+), 11 deletions(-)
> 
> diff --git a/libsepol/src/link.c b/libsepol/src/link.c
> index da65257a..188b4020 100644
> --- a/libsepol/src/link.c
> +++ b/libsepol/src/link.c
> @@ -1987,6 +1987,9 @@ static int is_decl_requires_met(link_state_t * state,
>  
>  
>  		if (!is_id_enabled(id, state->base, SYM_CLASSES)) {
> +			req->symbol_type = SYM_CLASSES;
> +			req->symbol_value = i + 1;
> +			req->perm_value = 0;
>  			return 0;
>  		}
>  
> @@ -2109,20 +2112,22 @@ static void print_missing_requirements(link_state_t * state,
>  	    cur->branch_list->module_name : "BASE";
>  
>  	if (req->symbol_type == SYM_CLASSES) {
> -
>  		struct find_perm_arg fparg;
> +		class_datum_t *cladatum = p->class_val_to_struct[req->symbol_value - 1];
>  
> -		class_datum_t *cladatum;
> -		cladatum = p->class_val_to_struct[req->symbol_value - 1];
> -
> -		fparg.valuep = req->perm_value;
> -		fparg.key = NULL;
> -		(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
> +		if (req->perm_value == 0) {
> +			ERR(state->handle, "%s's global requirements were not met: class %s",
> +				mod_name, p->p_class_val_to_name[req->symbol_value - 1]);
> +		} else {
> +			fparg.valuep = req->perm_value;
> +			fparg.key = NULL;
> +			(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
>  
> -		ERR(state->handle,
> -		    "%s's global requirements were not met: class %s, permission %s",
> -		    mod_name,
> -		    p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
> +			ERR(state->handle,
> +				"%s's global requirements were not met: class %s, permission %s",
> +				mod_name,
> +				p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
> +		}
>  	} else {
>  		ERR(state->handle,
>  		    "%s's global requirements were not met: %s %s",
> -- 
> 2.52.0
> 
>