libsepol: validate common classes have at least one permissions

The traditional language and CIL permit common classes only to be
defined with at least one permission.  Thus writing a common class
without one will fail.

Reported-by: oss-fuzz (issue 64059)
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>

libsepol/src/policydb_validate.c

@@ -370,7 +370,7 @@ static int validate_common_datum(sepol_handle_t *handle, const common_datum_t *c
 {
 	if (validate_value(common->s.value, &flavors[SYM_COMMONS]))
 		goto bad;
-	if (common->permissions.nprim > PERM_SYMTAB_SIZE)
+	if (common->permissions.table->nel == 0 || common->permissions.nprim > PERM_SYMTAB_SIZE)
 		goto bad;
 
 	return 0;