[PATCH 1/1] Fix error path in mls_semantic_level_expand().

[PATCH 1/1] Fix error path in mls_semantic_level_expand().

[Chris PeBenito]

If the level contains a category that is not associated with a sensitivity,
the code correctly detects the condition, but does not return an error.

Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
---
 libsepol/src/expand.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 467f7a7..3193ef5 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -914,10 +914,11 @@ int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l,
 		}
 		for (i = cat->low - 1; i < cat->high; i++) {
 			if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
-				ERR(h, "Category %s can not be associate with "
+				ERR(h, "Category %s can not be associated with "
 				    "level %s",
 				    p->p_cat_val_to_name[i],
 				    p->p_sens_val_to_name[l->sens - 1]);
+				return -1;
 			}
 			if (ebitmap_set_bit(&l->cat, i, 1)) {
 				ERR(h, "Out of memory!");
-- 
2.3.0

Re: [PATCH 1/1] Fix error path in mls_semantic_level_expand().

[Steve Lawrence]

On 02/22/2015 10:12 AM, Chris PeBenito wrote:
> If the level contains a category that is not associated with a sensitivity,
> the code correctly detects the condition, but does not return an error.
> 
> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>

Acked-by: Steve Lawrence <slawrence@tresys.com>

Thanks!

> ---
>  libsepol/src/expand.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
> index 467f7a7..3193ef5 100644
> --- a/libsepol/src/expand.c
> +++ b/libsepol/src/expand.c
> @@ -914,10 +914,11 @@ int mls_semantic_level_expand(mls_semantic_level_t * sl, mls_level_t * l,
>  		}
>  		for (i = cat->low - 1; i < cat->high; i++) {
>  			if (!ebitmap_get_bit(&levdatum->level->cat, i)) {
> -				ERR(h, "Category %s can not be associate with "
> +				ERR(h, "Category %s can not be associated with "
>  				    "level %s",
>  				    p->p_cat_val_to_name[i],
>  				    p->p_sens_val_to_name[l->sens - 1]);
> +				return -1;
>  			}
>  			if (ebitmap_set_bit(&l->cat, i, 1)) {
>  				ERR(h, "Out of memory!");
>