apparmor: ensure that dfa state tables have entries

Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.

Fixes: d901d6a298dc ("apparmor: dfa split verification of table headers")
Reported-by: Mike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

diff --git a/security/apparmor/match.c b/security/apparmor/match.c
index e605b7d53fb4b632d15380881d3132d1a24836b4..3e9e1eaf990ed7a953da87505e76c1123c9a5a11 100644 (file)
--- a/security/apparmor/match.c
+++ b/security/apparmor/match.c
@@ -97,6 +97,9 @@ static struct table_header *unpack_table(char *blob, size_t bsize)
              th.td_flags == YYTD_DATA8))
                goto out;
 
+       /* if we have a table it must have some entries */
+       if (th.td_lolen == 0)
+               goto out;
        tsize = table_size(th.td_lolen, th.td_flags);
        if (bsize < tsize)
                goto out;
@@ -198,6 +201,8 @@ static int verify_dfa(struct aa_dfa *dfa)
 
        state_count = dfa->tables[YYTD_ID_BASE]->td_lolen;
        trans_count = dfa->tables[YYTD_ID_NXT]->td_lolen;
+       if (state_count == 0)
+               goto out;
        for (i = 0; i < state_count; i++) {
                if (!(BASE_TABLE(dfa)[i] & MATCH_FLAG_DIFF_ENCODE) &&
                    (DEFAULT_TABLE(dfa)[i] >= state_count))