a suspicious integer overflow in libselinux/src/compute_user.c : 54 about selinux HOT 2 CLOSED

nel is read from a kernel pseudo file (/sys/fs/selinux/user, part of selinuxfs pseudo filesystem), so the value of nel originates from the kernel. The kernel in turn computes nel from the security policy configuration, which can only be loaded by authorized processes. Further, since nel is the number of elements in the array provided in the remainder of the buffer, and since selinuxfs only allows page-sized reads, a very large nel value will end up causing an error to be returned by the kernel since the array won't fit into the buffer. So this should never be possible.
That said, happy to take a patch that checks for integer overflow as a precaution. Patches preferably sent to selinux AT tycho.nsa.gov (subscribe via selinux-join AT tycho.nsa.gov).

from selinux.

Thanks for your explanation.
Since it is a false positive, i will close this issue.

from selinux.