[PATCH] libsepol: Free context on genfscon wildcard error in kernel_to_*

A policy with the policy capability genfs_seclabel_wildcard should
have all of its genfscon paths end with "*" (which is added for
backwards compatibility when compiling the policy). When converting
a kernel policy to CIL or a policy.conf, an error occurs if the
genfscon path does not end with "*". On this error path the context
is not freed in either kernel_to_cil or kernel_to_conf.

Free the context when exiting with an error for a genfscon path not
ending with a "*" when required.

Signed-off-by: James Carter <[email protected]>
---
 libsepol/src/kernel_to_cil.c  | 1 +
 libsepol/src/kernel_to_conf.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
index f64eb896..f274d597 100644
--- a/libsepol/src/kernel_to_cil.c
+++ b/libsepol/src/kernel_to_cil.c
@@ -2964,6 +2964,7 @@ static int write_genfscon_rules_to_cil(FILE *out, struct policydb *pdb)
 				    name[name_len - 1] != '*') {
 					ERR(NULL,
 					    "genfscon path must end with '*' when genfs_seclabel_wildcard");
+					free(ctx);
 					rc = -1;
 					goto exit;
 				}
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
index 9bfe5b38..c6e8fadd 100644
--- a/libsepol/src/kernel_to_conf.c
+++ b/libsepol/src/kernel_to_conf.c
@@ -2825,6 +2825,7 @@ static int write_genfscon_rules_to_conf(FILE *out, struct policydb *pdb)
 				    name[name_len - 1] != '*') {
 					ERR(NULL,
 					    "genfscon path must end with '*' when genfs_seclabel_wildcard");
+					free(ctx);
 					rc = -1;
 					goto exit;
 				}
-- 
2.55.0