svn commit: r337465 - stable/11/sys/security/mac

[Mark Johnston]

Author: markj
Date: Wed Aug  8 17:11:07 2018
New Revision: 337465
URL: https://svnweb.freebsd.org/changeset/base/337465

Log:
  MFC r337031:
  Require that MAC label buffers be able to store a non-empty string.

Modified:
  stable/11/sys/security/mac/mac_framework.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/security/mac/mac_framework.c
==============================================================================
--- stable/11/sys/security/mac/mac_framework.c	Wed Aug  8 17:10:32 2018	(r337464)
+++ stable/11/sys/security/mac/mac_framework.c	Wed Aug  8 17:11:07 2018	(r337465)
@@ -586,7 +586,9 @@ int
 mac_check_structmac_consistent(struct mac *mac)
 {
 
-	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
+	/* Require that labels have a non-zero length. */
+	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN ||
+	    mac->m_buflen <= sizeof(""))
 		return (EINVAL);
 
 	return (0);