| Message ID | 20161226211832.7165-1-nicolas.iooss@m4x.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
On 12/26/2016 04:18 PM, Nicolas Iooss wrote: > In an error path of define_bool_tunable(), variable id is freed after > being used by a successful call to declare_symbol(). This may cause > trouble as this pointer may have been used as-is in the policy symtab > hash table. > > Moreover bool_value is never freed after being used. Fix this memory > leak too. This leak has been detected with gcc Address Sanitizer. > > Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Applied. Thanks, > --- > checkpolicy/policy_define.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c > index 864788992e5c..2ad98c3c851e 100644 > --- a/checkpolicy/policy_define.c > +++ b/checkpolicy/policy_define.c > @@ -1704,11 +1704,11 @@ int define_bool_tunable(int is_tunable) > bool_value = (char *)queue_remove(id_queue); > if (!bool_value) { > yyerror("no default value for bool definition?"); > - free(id); > return -1; > } > > datum->state = (int)(bool_value[0] == 'T') ? 1 : 0; > + free(bool_value); > return 0; > cleanup: > cond_destroy_bool(id, datum, NULL); >
On Mon, 2016-12-26 at 22:18 +0100, Nicolas Iooss wrote: > In an error path of define_bool_tunable(), variable id is freed after > being used by a successful call to declare_symbol(). This may cause > trouble as this pointer may have been used as-is in the policy symtab > hash table. > > Moreover bool_value is never freed after being used. Fix this memory > leak too. This leak has been detected with gcc Address Sanitizer. > > Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Thanks, applied. > --- > checkpolicy/policy_define.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/checkpolicy/policy_define.c > b/checkpolicy/policy_define.c > index 864788992e5c..2ad98c3c851e 100644 > --- a/checkpolicy/policy_define.c > +++ b/checkpolicy/policy_define.c > @@ -1704,11 +1704,11 @@ int define_bool_tunable(int is_tunable) > bool_value = (char *)queue_remove(id_queue); > if (!bool_value) { > yyerror("no default value for bool definition?"); > - free(id); > return -1; > } > > datum->state = (int)(bool_value[0] == 'T') ? 1 : 0; > + free(bool_value); > return 0; > cleanup: > cond_destroy_bool(id, datum, NULL);
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c index 864788992e5c..2ad98c3c851e 100644 --- a/checkpolicy/policy_define.c +++ b/checkpolicy/policy_define.c @@ -1704,11 +1704,11 @@ int define_bool_tunable(int is_tunable) bool_value = (char *)queue_remove(id_queue); if (!bool_value) { yyerror("no default value for bool definition?"); - free(id); return -1; } datum->state = (int)(bool_value[0] == 'T') ? 1 : 0; + free(bool_value); return 0; cleanup: cond_destroy_bool(id, datum, NULL);
In an error path of define_bool_tunable(), variable id is freed after being used by a successful call to declare_symbol(). This may cause trouble as this pointer may have been used as-is in the policy symtab hash table. Moreover bool_value is never freed after being used. Fix this memory leak too. This leak has been detected with gcc Address Sanitizer. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> --- checkpolicy/policy_define.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)