Date: Thu, 18 Aug 2005 13:23:03 -0500
From: hallyn@serge.ibm.com
To: SELinux <selinux@tycho.nsa.gov>
Subject: [PATCH] libsepol: NULL dereference of tmp_roles[] on error path
Message-ID: <20050818182303.GD7622@serge.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-selinux@tycho.nsa.gov

The following patch addresses a bug found by Coverity:

	If the calloc for tmp_roles failed, we proceed to omem: where
	we dereference tmp_roles[1..num_roles].

Index: src/user_record.c
===================================================================
--- src.orig/user_record.c
+++ src/user_record.c
@@ -184,12 +184,14 @@ int sepol_user_set_roles(
 	DEBUG(__FUNCTION__, "out of memory, could not "
 		"allocate roles array for user %s\n", user->name);
 
-	for (i = 0; i < num_roles; i++ ) {
-		if (!tmp_roles[i])
-			break;
-		free(tmp_roles[i]);	
+	if (tmp_roles) {
+		for (i = 0; i < num_roles; i++ ) {
+			if (!tmp_roles[i])
+				break;
+			free(tmp_roles[i]);
+		}
+		free(tmp_roles);
 	}
-	free(tmp_roles);
 	return STATUS_ERR;	
 }
 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.