John Johansen c27c6bd2c4 apparmor: ensure that dfa state tables have entries ...

Currently it is possible to specify a state machine table with 0 length,
this is not valid as optional tables are specified by not defining
the table as present. Further this allows by-passing the base tables
range check against the next/check tables.

Fixes: d901d6a298 ("apparmor: dfa split verification of table headers")
Reported-by: Mike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>

2020-04-08 04:42:48 -07:00

20 KiB

Raw Blame History

View Raw