[PATCH] libsepol: Fix potential use of an uninitialized value in link.c

[PATCH] libsepol: Fix potential use of an uninitialized value in link.c

[James Carter]

The fields in struct missing_requirement are not assigned a value
in the case where a class is required but not in scope for an
optional block. This results in the use of an uninitialized value
in  print_missing_requirements(). The fields of the struct are
assigned correctly when the permission of a class is not in scope.

Assign values to the fields of the struct missing_requirement when
exiting early because the class is not in scope. Use 0 for the
permission index and only print the class name in
print_missing_requirements() if the permission index is 0.

Reported-by: oss-fuzz (issue 472084713)
Signed-off-by: James Carter <jwcart2@gmail.com>
---
 libsepol/src/link.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/libsepol/src/link.c b/libsepol/src/link.c
index da65257a..188b4020 100644
--- a/libsepol/src/link.c
+++ b/libsepol/src/link.c
@@ -1987,6 +1987,9 @@ static int is_decl_requires_met(link_state_t * state,
 
 
 		if (!is_id_enabled(id, state->base, SYM_CLASSES)) {
+			req->symbol_type = SYM_CLASSES;
+			req->symbol_value = i + 1;
+			req->perm_value = 0;
 			return 0;
 		}
 
@@ -2109,20 +2112,22 @@ static void print_missing_requirements(link_state_t * state,
 	    cur->branch_list->module_name : "BASE";
 
 	if (req->symbol_type == SYM_CLASSES) {
-
 		struct find_perm_arg fparg;
+		class_datum_t *cladatum = p->class_val_to_struct[req->symbol_value - 1];
 
-		class_datum_t *cladatum;
-		cladatum = p->class_val_to_struct[req->symbol_value - 1];
-
-		fparg.valuep = req->perm_value;
-		fparg.key = NULL;
-		(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
+		if (req->perm_value == 0) {
+			ERR(state->handle, "%s's global requirements were not met: class %s",
+				mod_name, p->p_class_val_to_name[req->symbol_value - 1]);
+		} else {
+			fparg.valuep = req->perm_value;
+			fparg.key = NULL;
+			(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
 
-		ERR(state->handle,
-		    "%s's global requirements were not met: class %s, permission %s",
-		    mod_name,
-		    p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
+			ERR(state->handle,
+				"%s's global requirements were not met: class %s, permission %s",
+				mod_name,
+				p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
+		}
 	} else {
 		ERR(state->handle,
 		    "%s's global requirements were not met: %s %s",
-- 
2.52.0

Re: [PATCH] libsepol: Fix potential use of an uninitialized value in link.c

[Jason Zaman]

On Thu, Jan 22, 2026 at 01:52:43PM -0500, James Carter wrote:
> The fields in struct missing_requirement are not assigned a value
> in the case where a class is required but not in scope for an
> optional block. This results in the use of an uninitialized value
> in  print_missing_requirements(). The fields of the struct are
> assigned correctly when the permission of a class is not in scope.
> 
> Assign values to the fields of the struct missing_requirement when
> exiting early because the class is not in scope. Use 0 for the
> permission index and only print the class name in
> print_missing_requirements() if the permission index is 0.
> 
> Reported-by: oss-fuzz (issue 472084713)
> Signed-off-by: James Carter <jwcart2@gmail.com>
Signed-off-by: Jason Zaman <jason@perfinion.com>

Thanks, applied.
> ---
>  libsepol/src/link.c | 27 ++++++++++++++++-----------
>  1 file changed, 16 insertions(+), 11 deletions(-)
> 
> diff --git a/libsepol/src/link.c b/libsepol/src/link.c
> index da65257a..188b4020 100644
> --- a/libsepol/src/link.c
> +++ b/libsepol/src/link.c
> @@ -1987,6 +1987,9 @@ static int is_decl_requires_met(link_state_t * state,
>  
>  
>  		if (!is_id_enabled(id, state->base, SYM_CLASSES)) {
> +			req->symbol_type = SYM_CLASSES;
> +			req->symbol_value = i + 1;
> +			req->perm_value = 0;
>  			return 0;
>  		}
>  
> @@ -2109,20 +2112,22 @@ static void print_missing_requirements(link_state_t * state,
>  	    cur->branch_list->module_name : "BASE";
>  
>  	if (req->symbol_type == SYM_CLASSES) {
> -
>  		struct find_perm_arg fparg;
> +		class_datum_t *cladatum = p->class_val_to_struct[req->symbol_value - 1];
>  
> -		class_datum_t *cladatum;
> -		cladatum = p->class_val_to_struct[req->symbol_value - 1];
> -
> -		fparg.valuep = req->perm_value;
> -		fparg.key = NULL;
> -		(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
> +		if (req->perm_value == 0) {
> +			ERR(state->handle, "%s's global requirements were not met: class %s",
> +				mod_name, p->p_class_val_to_name[req->symbol_value - 1]);
> +		} else {
> +			fparg.valuep = req->perm_value;
> +			fparg.key = NULL;
> +			(void)hashtab_map(cladatum->permissions.table, find_perm, &fparg);
>  
> -		ERR(state->handle,
> -		    "%s's global requirements were not met: class %s, permission %s",
> -		    mod_name,
> -		    p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
> +			ERR(state->handle,
> +				"%s's global requirements were not met: class %s, permission %s",
> +				mod_name,
> +				p->p_class_val_to_name[req->symbol_value - 1], fparg.key);
> +		}
>  	} else {
>  		ERR(state->handle,
>  		    "%s's global requirements were not met: %s %s",
> -- 
> 2.52.0
> 
>