aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux/ss/conditional.h
diff options
context:
space:
mode:
authorVesa-Matti Kari <vmkari@cc.helsinki.fi>2008-08-06 11:24:51 -0400
committerJames Morris <jmorris@namei.org>2008-08-06 18:56:16 -0400
commit421fae06be9e0dac45747494756b3580643815f9 (patch)
tree8b390e53636092477c82304b7f7f10524df6fd1b /security/selinux/ss/conditional.h
parent15446235367fa4a621ff5abfa4b6ebbe25b33763 (diff)
selinux: conditional expression type validation was off-by-one
expr_isvalid() in conditional.c was off-by-one and allowed invalid expression type COND_LAST. However, it is this header file that needs to be fixed. That way the if-statement's disjunction's second component reads more naturally, "if expr type is greater than the last allowed value" ( rather than using ">=" in conditional.c): if (expr->expr_type <= 0 || expr->expr_type > COND_LAST) Signed-off-by: Vesa-Matti Kari <vmkari@cc.helsinki.fi> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/selinux/ss/conditional.h')
-rw-r--r--security/selinux/ss/conditional.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/selinux/ss/conditional.h b/security/selinux/ss/conditional.h
index 65b9f8366e9c..53ddb013ae57 100644
--- a/security/selinux/ss/conditional.h
+++ b/security/selinux/ss/conditional.h
@@ -28,7 +28,7 @@ struct cond_expr {
28#define COND_XOR 5 /* bool ^ bool */ 28#define COND_XOR 5 /* bool ^ bool */
29#define COND_EQ 6 /* bool == bool */ 29#define COND_EQ 6 /* bool == bool */
30#define COND_NEQ 7 /* bool != bool */ 30#define COND_NEQ 7 /* bool != bool */
31#define COND_LAST 8 31#define COND_LAST COND_NEQ
32 __u32 expr_type; 32 __u32 expr_type;
33 __u32 bool; 33 __u32 bool;
34 struct cond_expr *next; 34 struct cond_expr *next;