tomoyo: Limit wildcard recursion depth.

Since wildcards that need recursion consume kernel stack memory (or might
cause CPU stall warning problem), we cannot allow infinite recursion.

Since TOMOYO 1.8 survived with 20 recursions limit for 5 years, nobody
would complain if applying this limit to TOMOYO 2.6.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
This commit is contained in:
Tetsuo Handa 2020-11-03 13:17:40 +09:00
parent d9594e0409
commit e991a40b3d

View File

@ -434,59 +434,64 @@ void tomoyo_normalize_line(unsigned char *buffer)
*/
static bool tomoyo_correct_word2(const char *string, size_t len)
{
u8 recursion = 20;
const char *const start = string;
bool in_repetition = false;
unsigned char c;
unsigned char d;
unsigned char e;
if (!len)
goto out;
while (len--) {
c = *string++;
unsigned char c = *string++;
if (c == '\\') {
if (!len--)
goto out;
c = *string++;
if (c >= '0' && c <= '3') {
unsigned char d;
unsigned char e;
if (!len-- || !len--)
goto out;
d = *string++;
e = *string++;
if (d < '0' || d > '7' || e < '0' || e > '7')
goto out;
c = tomoyo_make_byte(c, d, e);
if (c <= ' ' || c >= 127)
continue;
goto out;
}
switch (c) {
case '\\': /* "\\" */
continue;
case '$': /* "\$" */
case '+': /* "\+" */
case '?': /* "\?" */
case 'x': /* "\x" */
case 'a': /* "\a" */
case '-': /* "\-" */
continue;
}
if (!recursion--)
goto out;
switch (c) {
case '*': /* "\*" */
case '@': /* "\@" */
case 'x': /* "\x" */
case '$': /* "\$" */
case 'X': /* "\X" */
case 'a': /* "\a" */
case 'A': /* "\A" */
case '-': /* "\-" */
continue;
case '{': /* "/\{" */
if (string - 3 < start || *(string - 3) != '/')
break;
goto out;
in_repetition = true;
continue;
case '}': /* "\}/" */
if (*string != '/')
break;
goto out;
if (!in_repetition)
break;
goto out;
in_repetition = false;
continue;
case '0': /* "\ooo" */
case '1':
case '2':
case '3':
if (!len-- || !len--)
break;
d = *string++;
e = *string++;
if (d < '0' || d > '7' || e < '0' || e > '7')
break;
c = tomoyo_make_byte(c, d, e);
if (c <= ' ' || c >= 127)
continue;
}
goto out;
} else if (in_repetition && c == '/') {