topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2025-03-01 16:05:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libsepol: clean memory on conditional insertion failure

Browse Source 
Free the local access vector list on failure as it does not get moved
into the policy structure.
Drop the now redundant, but non-exhaustive, resource cleanup in
cond_insertf().

    Direct leak of 16 byte(s) in 1 object(s) allocated from:
        #0 0x52596d in malloc (./out/binpolicy-fuzzer+0x52596d)
        #1 0x5b30d2 in cond_insertf ./libsepol/src/conditional.c:682:9
        #2 0x5ac218 in avtab_read_item ./libsepol/src/avtab.c:583:10
        #3 0x5b21f4 in cond_read_av_list ./libsepol/src/conditional.c:725:8
        #4 0x5b21f4 in cond_read_node ./libsepol/src/conditional.c:798:7
        #5 0x5b21f4 in cond_read_list ./libsepol/src/conditional.c:847:7
        #6 0x576b6e in policydb_read ./libsepol/src/policydb.c:4436:8
        #7 0x55a1fe in LLVMFuzzerTestOneInput ./libsepol/fuzz/binpolicy-fuzzer.c:24:6
        #8 0x45aed3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) fuzzer.o
        #9 0x446a12 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) fuzzer.o
        #10 0x44c93b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) fuzzer.o
        #11 0x475dd2 in main (./out/binpolicy-fuzzer+0x475dd2)
        #12 0x7f47abeb87ec in __libc_start_main csu/../csu/libc-start.c:332:16

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
This commit is contained in:
Christian Göttsche 2021-12-09 17:49:04 +01:00 committed by James Carter
parent 2331dcaf8e
commit f571438ac0
1 changed files with 9 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libsepol/src/conditional.c
View File

@ -634,7 +634,7 @@ static int cond_insertf(avtab_t * a
if (k->specified & AVTAB_TYPE) {
if (avtab_search(&p->te_avtab, k)) {
WARN(NULL, "security: type rule already exists outside of a conditional.");
goto err;
return -1;
}
/*
* If we are reading the false list other will be a pointer to
@ -650,7 +650,7 @@ static int cond_insertf(avtab_t * a
if (avtab_search_node_next
(node_ptr, k->specified)) {
ERR(NULL, "security: too many conflicting type rules.");
goto err;
return -1;
}
found = 0;
for (cur = other; cur != NULL; cur = cur->next) {
@ -661,13 +661,13 @@ static int cond_insertf(avtab_t * a
}
if (!found) {
ERR(NULL, "security: conflicting type rules.\n");
goto err;
return -1;
}
}
} else {
if (avtab_search(&p->te_cond_avtab, k)) {
ERR(NULL, "security: conflicting type rules when adding type rule for true.\n");
goto err;
return -1;
}
}
}
@ -675,13 +675,13 @@ static int cond_insertf(avtab_t * a
node_ptr = avtab_insert_nonunique(&p->te_cond_avtab, k, d);
if (!node_ptr) {
ERR(NULL, "security: could not insert rule.");
goto err;
return -1;
}
node_ptr->parse_context = (void *)1;
list = malloc(sizeof(cond_av_list_t));
if (!list)
goto err;
return -1;
memset(list, 0, sizeof(cond_av_list_t));
list->node = node_ptr;
@ -691,11 +691,6 @@ static int cond_insertf(avtab_t * a
data->tail->next = list;
data->tail = list;
return 0;
err:
cond_av_list_destroy(data->head);
data->head = NULL;
return -1;
}
static int cond_read_av_list(policydb_t * p, void *fp,
@ -724,8 +719,10 @@ static int cond_read_av_list(policydb_t * p, void *fp,
for (i = 0; i < len; i++) {
rc = avtab_read_item(fp, p->policyvers, &p->te_cond_avtab,
cond_insertf, &data);
if (rc)
if (rc) {
cond_av_list_destroy(data.head);
return rc;
}
}