Commit af15f14c authored Apr 14, 2020 by Ondrej Mosnacek Committed by Paul Moore Apr 15, 2020

selinux: free str on error in str_read()



In [see "Fixes:"] I missed the fact that str_read() may give back an
allocated pointer even if it returns an error, causing a potential
memory leak in filename_trans_read_one(). Fix this by making the
function free the allocated string whenever it returns a non-zero value,
which also makes its behavior more obvious and prevents repeating the
same mistake in the future.

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1461665 ("Resource leaks")
Fixes: c3a27611 ("selinux: optimize storage of filename transitions")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent c753924b

security/selinux/ss/policydb.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -1035,14 +1035,14 @@ static int str_read(char *strp, gfp_t flags, void fp, u32 len)
		if (!str)
		return -ENOMEM;

		/* it's expected the caller should free the str */
		*strp = str;

		rc = next_entry(str, fp, len);
		if (rc)
		if (rc) {
		kfree(str);
		return rc;
		}

		str[len] = '\0';
		*strp = str;
		return 0;
		}

Admin message