From: Petr Lautrbach <plautrba@redhat.com>
To: selinux@vger.kernel.org
Cc: James Carter <jwcart2@tycho.nsa.gov>
Subject: Re: [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
Date: Mon, 04 Feb 2019 18:44:13 +0100 [thread overview]
Message-ID: <pjd8syv1maa.fsf@redhat.com> (raw)
In-Reply-To: <20190201210802.8822-1-jwcart2@tycho.nsa.gov>
James Carter <jwcart2@tycho.nsa.gov> writes:
> These were reported by Petr Lautrbach (plautrba@redhat.com) and
> this
> patch was based on his patch with only a few changes.
>
> Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
The following list of Coverity scan defects are fixed by this
patch
https://plautrba.fedorapeople.org/selinux/20190204-libsepol-fixed-RESOURCE_LEAK.txt
Thanks!
Acked-by: Petr Lautrbach <plautrba@redhat.com>
> ---
> libsepol/cil/src/cil_binary.c | 13 ++++++++++++-
> libsepol/cil/src/cil_resolve_ast.c | 9 +++++++++
> libsepol/cil/src/cil_symtab.c | 1 +
> libsepol/src/expand.c | 6 ++++++
> libsepol/src/kernel_to_cil.c | 2 ++
> libsepol/src/kernel_to_conf.c | 2 ++
> 6 files changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil_binary.c
> b/libsepol/cil/src/cil_binary.c
> index 0cc6eeb1..a10c3763 100644
> --- a/libsepol/cil/src/cil_binary.c
> +++ b/libsepol/cil/src/cil_binary.c
> @@ -54,6 +54,7 @@
> #include "cil_binary.h"
> #include "cil_symtab.h"
> #include "cil_find.h"
> +#include "cil_build_ast.h"
>
> /* There are 44000 filename_trans in current fedora policy.
> 1.33 times this is the recommended
> * size of a hashtable. The next power of 2 of this is 2 ** 16.
> @@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t
> *pdb, struct cil_alias *cil_alias)
>
> exit:
> level_datum_destroy(sepol_alias);
> - free(sepol_level);
> + free(sepol_alias);
> free(key);
> return rc;
> }
> @@ -1763,11 +1764,13 @@ int
> __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind,
> uint32_t src, u
> hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
> rc = ebitmap_cpy(hashtab_xperms, xperms);
> if (rc != SEPOL_OK) {
> + free(hashtab_xperms);
> free(avtab_key);
> goto exit;
> }
> rc = hashtab_insert(h, (hashtab_key_t)avtab_key,
> hashtab_xperms);
> if (rc != SEPOL_OK) {
> + free(hashtab_xperms);
> free(avtab_key);
> goto exit;
> }
> @@ -2157,6 +2160,7 @@ static int
> __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct
> cil_list
> op->expr_type = COND_NEQ;
> break;
> default:
> + free(op);
> goto exit;
> }
>
> @@ -2283,6 +2287,7 @@ int cil_booleanif_to_policydb(policydb_t
> *pdb, const struct cil_db *db, struct c
>
> cond_expr_destroy(tmp_cond->expr);
> free(tmp_cond);
> + tmp_cond = NULL;
>
> for (cb_node = node->cl_head; cb_node != NULL; cb_node =
> cb_node->next) {
> if (cb_node->flavor == CIL_CONDBLOCK) {
> @@ -2327,6 +2332,11 @@ int cil_booleanif_to_policydb(policydb_t
> *pdb, const struct cil_db *db, struct c
> return SEPOL_OK;
>
> exit:
> + if (tmp_cond) {
> + if (tmp_cond->expr)
> + cond_expr_destroy(tmp_cond->expr);
> + free(tmp_cond);
> + }
> return rc;
> }
>
> @@ -4797,6 +4807,7 @@ static struct cil_list
> *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
> return cp_list;
>
> exit:
> + cil_destroy_classperms(cp);
> cil_log(CIL_ERR,"Failed to create CIL class-permissions from
> sepol values\n");
> return NULL;
> }
> diff --git a/libsepol/cil/src/cil_resolve_ast.c
> b/libsepol/cil/src/cil_resolve_ast.c
> index fb9d9174..ea08087d 100644
> --- a/libsepol/cil/src/cil_resolve_ast.c
> +++ b/libsepol/cil/src/cil_resolve_ast.c
> @@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct
> cil_tree_node *current, void *extra_args)
> return SEPOL_OK;
>
> exit:
> + cil_list_destroy(&new, CIL_FALSE);
> return rc;
> }
>
> @@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct
> cil_tree_node *current, void *extra_args)
> return SEPOL_OK;
>
> exit:
> + cil_list_destroy(&new, CIL_FALSE);
> return rc;
> }
>
> @@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct
> cil_tree_node *current, void *extra_args
> return SEPOL_OK;
>
> exit:
> + cil_list_destroy(&new, CIL_FALSE);
> return rc;
> }
>
> @@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> rc = cil_fill_cats(pc, &catset->cats);
> if (rc != SEPOL_OK) {
> cil_destroy_catset(catset);
> + cil_destroy_args(new_arg);
> goto exit;
> }
> cil_tree_node_init(&cat_node);
> @@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> if (rc != SEPOL_OK) {
> cil_log(CIL_ERR, "Failed to create anonymous level,
> rc: %d\n", rc);
> cil_destroy_level(level);
> + cil_destroy_args(new_arg);
> goto exit;
> }
> cil_tree_node_init(&lvl_node);
> @@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> if (rc != SEPOL_OK) {
> cil_log(CIL_ERR, "Failed to create anonymous
> levelrange, rc: %d\n", rc);
> cil_destroy_levelrange(range);
> + cil_destroy_args(new_arg);
> goto exit;
> }
> cil_tree_node_init(&range_node);
> @@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> if (rc != SEPOL_OK) {
> cil_log(CIL_ERR, "Failed to create anonymous ip
> address, rc: %d\n", rc);
> cil_destroy_ipaddr(ipaddr);
> + cil_destroy_args(new_arg);
> goto exit;
> }
> cil_tree_node_init(&addr_node);
> @@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> if (rc != SEPOL_OK) {
> cil_log(CIL_ERR, "Failed to create anonymous
> classpermission\n");
> cil_destroy_classpermission(cp);
> + cil_destroy_args(new_arg);
> goto exit;
> }
> cil_tree_node_init(&cp_node);
> @@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node
> *current, void *extra_args)
> default:
> cil_log(CIL_ERR, "Unexpected flavor: %d\n",
> (((struct cil_param*)item->data)->flavor));
> + cil_destroy_args(new_arg);
> rc = SEPOL_ERR;
> goto exit;
> }
> diff --git a/libsepol/cil/src/cil_symtab.c
> b/libsepol/cil/src/cil_symtab.c
> index 3769979b..2970b863 100644
> --- a/libsepol/cil/src/cil_symtab.c
> +++ b/libsepol/cil/src/cil_symtab.c
> @@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct
> cil_complex_symtab *symtab,
> ckey->key2 == curr->ckey->key2 &&
> ckey->key3 == curr->ckey->key3 &&
> ckey->key4 == curr->ckey->key4) {
> + free(node);
> return SEPOL_EEXIST;
> }
>
> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
> index 6f1b235e..312d137b 100644
> --- a/libsepol/src/expand.c
> +++ b/libsepol/src/expand.c
> @@ -1451,6 +1451,7 @@ static int
> expand_filename_trans(expand_state_t *state,
> filename_trans_rule_t *r
> new_trans->name = strdup(cur_rule->name);
> if (!new_trans->name) {
> ERR(state->handle, "Out of memory!");
> + free(new_trans);
> return -1;
> }
> new_trans->stype = i + 1;
> @@ -1460,6 +1461,8 @@ static int
> expand_filename_trans(expand_state_t *state,
> filename_trans_rule_t *r
> otype = calloc(1, sizeof(*otype));
> if (!otype) {
> ERR(state->handle, "Out of memory!");
> + free(new_trans->name);
> + free(new_trans);
> return -1;
> }
> otype->otype = mapped_otype;
> @@ -1469,6 +1472,9 @@ static int
> expand_filename_trans(expand_state_t *state,
> filename_trans_rule_t *r
> otype);
> if (rc) {
> ERR(state->handle, "Out of memory!");
> + free(otype);
> + free(new_trans->name);
> + free(new_trans);
> return -1;
> }
> }
> diff --git a/libsepol/src/kernel_to_cil.c
> b/libsepol/src/kernel_to_cil.c
> index 63e4d489..ec82f597 100644
> --- a/libsepol/src/kernel_to_cil.c
> +++ b/libsepol/src/kernel_to_cil.c
> @@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE
> *out, struct policydb *pdb, cond_av_li
> return 0;
>
> exit:
> + strs_free_all(strs);
> + strs_destroy(&strs);
> return rc;
> }
>
> diff --git a/libsepol/src/kernel_to_conf.c
> b/libsepol/src/kernel_to_conf.c
> index 215d940c..afadca6b 100644
> --- a/libsepol/src/kernel_to_conf.c
> +++ b/libsepol/src/kernel_to_conf.c
> @@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE
> *out, struct policydb *pdb, cond_av_l
> return 0;
>
> exit:
> + strs_free_all(strs);
> + strs_destroy(&strs);
> return rc;
> }
next prev parent reply other threads:[~2019-02-04 17:44 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-01 21:08 [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan James Carter
2019-02-04 17:44 ` Petr Lautrbach [this message]
2019-02-06 8:07 ` Petr Lautrbach
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=pjd8syv1maa.fsf@redhat.com \
--to=plautrba@redhat.com \
--cc=jwcart2@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.