selinux: Fix an uninitialized variable bug in range_read()

[Paul Moore]

On Sat, Apr 1, 2017 at 2:40 AM, SF Markus Elfring
<elfring at users.sourceforge.net> wrote:
>>>> We removed this initialization as a cleanup but it is probably
>>>> required.
>>>>
>>>> The concern is that "nel" can be zero.  I'm not an expert on SELinux
>>>> code but I think it looks possible to write an SELinux policy which
>>>> triggers this bug.  GCC doesn't catch this, but my static checker
>>>> does.
>>>>
>>>> Fixes: 9c312e79d6af ("selinux: Delete an unnecessary variable
>>>> initialisation in range_read()")
>>>> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
>>>
>>> Nice catch, thanks!
>>>
>>> Acked-by: Stephen Smalley <sds at tycho.nsa.gov>
>>
>> Yes, indeed.  Thanks Dan, I should have caught this when merging Markus' patch.
>
> How do you think about the possibility to call the function “range_read” only with
> a system configuration where the interface “le32_to_cpu” will be resolved to
> a positive value so that statements in the corresponding for loop will be executed
> at least once?

I suggest we leave this as-is for the moment.

-- 
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html