Skip to contentSkip to conversation

libsepol: NULL dereference of tmp_roles[] on error path

PATCH New [email protected] 1 participant 1 message Aug 18, 2005 SELinux security module

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 libsepol: NULL dereference of tmp_roles[] on error path

The following patch addresses a bug found by Coverity:

If the calloc for tmp_roles failed, we proceed to omem: where we dereference tmp_roles[1..num_roles].

user_record.c +7 -5
Index: src/user_record.c
===================================================================
@@ -184,12 +184,14 @@ int sepol_user_set_roles(
 	DEBUG(__FUNCTION__, "out of memory, could not "
 		"allocate roles array for user %s\n", user->name);
 
-	for (i = 0; i < num_roles; i++ ) {
-		if (!tmp_roles[i])
-			break;
-		free(tmp_roles[i]);	
+	if (tmp_roles) {
+		for (i = 0; i < num_roles; i++ ) {
+			if (!tmp_roles[i])
+				break;
+			free(tmp_roles[i]);
+		}
+		free(tmp_roles);
 	}
-	free(tmp_roles);
 	return STATUS_ERR;	
 }

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.