Date: Thu, 18 Aug 2005 13:22:19 -0500
From: hallyn@serge.ibm.com
To: SELinux <selinux@tycho.nsa.gov>
Subject: [PATCH] libsepol: potential NULL dereference from next_entry()
Message-ID: <20050818182219.GC7622@serge.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-selinux@tycho.nsa.gov

This patch fixes a bug found by Coverity:

	If next_entry returns NULL in role_trans_rule_read(),
	we nevertheless reference buf[0].

Index: src/policydb.c
===================================================================
--- src.orig/policydb.c
+++ src/policydb.c
@@ -2145,6 +2145,8 @@ static int role_trans_rule_read(role_tra
                         return -1;
 
                 buf = next_entry(fp, sizeof(uint32_t));
+		if (!buf)
+			return -1;
                 tr->new_role = le32_to_cpu(buf[0]);
                 ltr = tr;
         }

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.