db: return EINVAL if there are any unknown flags set in the compariso…

…n op Signed-off-by: James Henstridge <james.henstridge@canonical.com>
seccomp · May 12, 2022 · 516fb01 · 516fb01
1 parent 6bdc497
commit 516fb01
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/db.c b/src/db.c
@@ -2331,6 +2331,11 @@ int db_col_rule_add(struct db_filter_col *col,
 				rc = -EINVAL;
 				goto add_return;
 			}
+                        /* Check that no unknown flags are specified in the op */
+                        if ((arg_data.op & ~(SCMP_CMP_OPMASK | SCMP_CMP_32BIT)) != 0) {
+                            rc = -EINVAL;
+                            goto add_return;
+                        }
 		} else {
 			rc = -EINVAL;
 			goto add_return;