-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
rhel-9.4
-
None
-
Low
-
1
-
rhel-sst-security-selinux
-
ssg_security
-
2
-
False
-
-
No
-
CY24Q2
-
-
None
-
None
-
Unspecified Release Note Type - Unknown
-
None
Error: STRING_NULL (CWE-170): [#def5]
selinux-3.6/restorecond/utmpwatcher.c:62: string_null_source: Function "fread" does not terminate string "u". [Note: The source code implementation of the function has been overridden by a builtin model.]
selinux-3.6/restorecond/utmpwatcher.c:64: string_null: Passing unterminated string "u.ut_user" to "strings_list_add", which expects a null-terminated string.
# 62| while (fread(&u, sizeof(struct utmp), 1, cfg) > 0) {
# 63| if (u.ut_type == USER_PROCESS)
# 64|-> strings_list_add(&utmp_ptr, u.ut_user);
# 65| }
# 66| fclose(cfg);
`man utmp` -> "This structure gives the name of the special file associated with the user's terminal, the user's login name, and the time of login in the form of time(2). String fields are terminated by a null byte ('\0') if they are shorter than the size of the field.
"