[PATCH] checkpolicy: fix double free of fstype in define_genfs_context_helper
shafiuzzaman-md <[email protected]>
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <[email protected]> |
From: Md Shafiuzzaman <[email protected]> When parsing a new filesystem type, define_genfs_context_helper() transfers ownership of fstype into a genfs struct linked into the policydb's genfs list, but does not clear the local fstype. A later goto fail then frees it, leaving a dangling pointer that policydb_destroy() frees again. Clear fstype after the ownership transfer, mirroring the else branch. Reported-by: Md Shafiuzzaman <[email protected]> Signed-off-by: Md Shafiuzzaman <[email protected]> --- checkpolicy/policy_define.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c index 982de3f..3015782 100644 --- a/checkpolicy/policy_define.c +++ b/checkpolicy/policy_define.c @@ -6054,6 +6054,8 @@ static int define_genfs_context_helper(char *fstype, int has_type) return -1; } newgenfs->fstype = fstype; + /* ownership transferred into the genfs list; do not free on error */ + fstype = NULL; newgenfs->next = genfs; if (genfs_p) genfs_p->next = newgenfs; -- 2.54.0