summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--security/tomoyo/util.c55
1 files changed, 30 insertions, 25 deletions
diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index a40abb0b91ee..176b803ebcfc 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -434,59 +434,64 @@ void tomoyo_normalize_line(unsigned char *buffer)
*/
static bool tomoyo_correct_word2(const char *string, size_t len)
{
+ u8 recursion = 20;
const char *const start = string;
bool in_repetition = false;
- unsigned char c;
- unsigned char d;
- unsigned char e;
if (!len)
goto out;
while (len--) {
- c = *string++;
+ unsigned char c = *string++;
+
if (c == '\\') {
if (!len--)
goto out;
c = *string++;
+ if (c >= '0' && c <= '3') {
+ unsigned char d;
+ unsigned char e;
+
+ if (!len-- || !len--)
+ goto out;
+ d = *string++;
+ e = *string++;
+ if (d < '0' || d > '7' || e < '0' || e > '7')
+ goto out;
+ c = tomoyo_make_byte(c, d, e);
+ if (c <= ' ' || c >= 127)
+ continue;
+ goto out;
+ }
switch (c) {
case '\\': /* "\\" */
- continue;
- case '$': /* "\$" */
case '+': /* "\+" */
case '?': /* "\?" */
+ case 'x': /* "\x" */
+ case 'a': /* "\a" */
+ case '-': /* "\-" */
+ continue;
+ }
+ if (!recursion--)
+ goto out;
+ switch (c) {
case '*': /* "\*" */
case '@': /* "\@" */
- case 'x': /* "\x" */
+ case '$': /* "\$" */
case 'X': /* "\X" */
- case 'a': /* "\a" */
case 'A': /* "\A" */
- case '-': /* "\-" */
continue;
case '{': /* "/\{" */
if (string - 3 < start || *(string - 3) != '/')
- break;
+ goto out;
in_repetition = true;
continue;
case '}': /* "\}/" */
if (*string != '/')
- break;
+ goto out;
if (!in_repetition)
- break;
+ goto out;
in_repetition = false;
continue;
- case '0': /* "\ooo" */
- case '1':
- case '2':
- case '3':
- if (!len-- || !len--)
- break;
- d = *string++;
- e = *string++;
- if (d < '0' || d > '7' || e < '0' || e > '7')
- break;
- c = tomoyo_make_byte(c, d, e);
- if (c <= ' ' || c >= 127)
- continue;
}
goto out;
} else if (in_repetition && c == '/') {