Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752710AbdHVV6g (ORCPT ); Tue, 22 Aug 2017 17:58:36 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:33556 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751651AbdHVV6e (ORCPT ); Tue, 22 Aug 2017 17:58:34 -0400 From: Colin King To: John Johansen , James Morris , "Serge E . Hallyn" , linux-security-module@vger.kernel.org Cc: linux-kernel@vger.kernel.org Subject: [PATCH] apparmor: fix off-by-one comparison on MAXMAPPED_SIG Date: Tue, 22 Aug 2017 22:58:32 +0100 Message-Id: <20170822215832.5504-1-colin.king@canonical.com> X-Mailer: git-send-email 2.14.1 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1017 Lines: 31 From: Colin Ian King There is a an off-by-one comparision on sig against MAXMAPPED_SIG that can lead to a read outside the sig_map array if sig is MAXMAPPED_SIG. Fix this. Detected with cppcheck: "Either the condition 'sig<=35' is redundant or the array 'sig_map[35]' is accessed at index 35, which is out of bounds." Fixes: c6bf1adaecaa ("apparmor: add the ability to mediate signals") Signed-off-by: Colin Ian King --- security/apparmor/ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c index 66fb9ede9447..5091c78062e4 100644 --- a/security/apparmor/ipc.c +++ b/security/apparmor/ipc.c @@ -128,7 +128,7 @@ static inline int map_signal_num(int sig) return SIGUNKNOWN; else if (sig >= SIGRTMIN) return sig - SIGRTMIN + 128; /* rt sigs mapped to 128 */ - else if (sig <= MAXMAPPED_SIG) + else if (sig < MAXMAPPED_SIG) return sig_map[sig]; return SIGUNKNOWN; } -- 2.14.1