sepol_av_to_string does not NULL-terminate string if av == 0

[chenxiaolong]

The current implementation of sepol_av_to_string does not NULL-terminate avbuf if av == 0 or if none of the bits match a permission.

char *sepol_av_to_string(policydb_t * policydbp, uint32_t tclass,
			 sepol_access_vector_t av)
{
	// ...
	static char avbuf[1024];
	// ...
	for (i = 0; i < cladatum->permissions.nprim; i++) {
		if (av & (1 << i)) {
			// ...
			if (perm) {
				len =
				    snprintf(p, sizeof(avbuf) - avlen, " %s",
					     perm);
				// ...
			}
		}
	}

	return avbuf;
}

This may not be an issue if av is validated elsewhere. I'm personally using libsepol to disable all the auditdeny/dontaudit rules by removing the permission bits (ie. av_cur->datum.data = ~0U) and ran into this issue trying to print the result.

EDIT: The buffer may be NULL-terminated since static arrays are zero-initialized, but with the inputs mentioned above, the result is still incorrect.

[stephensmalley]

Thanks, want to submit a patch to selinux AT tycho.nsa.gov?

[chenxiaolong]

@stephensmalley Sure, I'll get approval from my employer to contribute outside of work and then I'll submit a patch.

[chenxiaolong]

@stephensmalley Thanks for fixing this! I was not able to get an approval in time.