From: Petr Lautrbach <plautrba@redhat.com>
To: selinux@vger.kernel.org
Cc: James Carter <jwcart2@tycho.nsa.gov>
Subject: Re: [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
Date: Wed, 06 Feb 2019 09:07:09 +0100 [thread overview]
Message-ID: <pjdpns5z6fm.fsf@redhat.com> (raw)
In-Reply-To: <pjd8syv1maa.fsf@redhat.com> (Petr Lautrbach's message of "Mon, 04 Feb 2019 18:44:13 +0100")
Petr Lautrbach <plautrba@redhat.com> writes:
> James Carter <jwcart2@tycho.nsa.gov> writes:
>
>> These were reported by Petr Lautrbach (plautrba@redhat.com) and this
>> patch was based on his patch with only a few changes.
>>
>> Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
>
> The following list of Coverity scan defects are fixed by this patch
> https://plautrba.fedorapeople.org/selinux/20190204-libsepol-fixed-RESOURCE_LEAK.txt
>
> Thanks!
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>
Merged.
>
>> ---
>> libsepol/cil/src/cil_binary.c | 13 ++++++++++++-
>> libsepol/cil/src/cil_resolve_ast.c | 9 +++++++++
>> libsepol/cil/src/cil_symtab.c | 1 +
>> libsepol/src/expand.c | 6 ++++++
>> libsepol/src/kernel_to_cil.c | 2 ++
>> libsepol/src/kernel_to_conf.c | 2 ++
>> 6 files changed, 32 insertions(+), 1 deletion(-)
>>
>> diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
>> index 0cc6eeb1..a10c3763 100644
>> --- a/libsepol/cil/src/cil_binary.c
>> +++ b/libsepol/cil/src/cil_binary.c
>> @@ -54,6 +54,7 @@
>> #include "cil_binary.h"
>> #include "cil_symtab.h"
>> #include "cil_find.h"
>> +#include "cil_build_ast.h"
>> /* There are 44000 filename_trans in current fedora policy. 1.33 times this
>> is the recommended
>> * size of a hashtable. The next power of 2 of this is 2 ** 16.
>> @@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct
>> cil_alias *cil_alias)
>> exit:
>> level_datum_destroy(sepol_alias);
>> - free(sepol_level);
>> + free(sepol_alias);
>> free(key);
>> return rc;
>> }
>> @@ -1763,11 +1764,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h,
>> uint16_t kind, uint32_t src, u
>> hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
>> rc = ebitmap_cpy(hashtab_xperms, xperms);
>> if (rc != SEPOL_OK) {
>> + free(hashtab_xperms);
>> free(avtab_key);
>> goto exit;
>> }
>> rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms);
>> if (rc != SEPOL_OK) {
>> + free(hashtab_xperms);
>> free(avtab_key);
>> goto exit;
>> }
>> @@ -2157,6 +2160,7 @@ static int
>> __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list
>> op->expr_type = COND_NEQ;
>> break;
>> default:
>> + free(op);
>> goto exit;
>> }
>> @@ -2283,6 +2287,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const
>> struct cil_db *db, struct c
>> cond_expr_destroy(tmp_cond->expr);
>> free(tmp_cond);
>> + tmp_cond = NULL;
>> for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) {
>> if (cb_node->flavor == CIL_CONDBLOCK) {
>> @@ -2327,6 +2332,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const
>> struct cil_db *db, struct c
>> return SEPOL_OK;
>> exit:
>> + if (tmp_cond) {
>> + if (tmp_cond->expr)
>> + cond_expr_destroy(tmp_cond->expr);
>> + free(tmp_cond);
>> + }
>> return rc;
>> }
>> @@ -4797,6 +4807,7 @@ static struct cil_list
>> *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
>> return cp_list;
>> exit:
>> + cil_destroy_classperms(cp);
>> cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol
>> values\n");
>> return NULL;
>> }
>> diff --git a/libsepol/cil/src/cil_resolve_ast.c
>> b/libsepol/cil/src/cil_resolve_ast.c
>> index fb9d9174..ea08087d 100644
>> --- a/libsepol/cil/src/cil_resolve_ast.c
>> +++ b/libsepol/cil/src/cil_resolve_ast.c
>> @@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current,
>> void *extra_args)
>> return SEPOL_OK;
>> exit:
>> + cil_list_destroy(&new, CIL_FALSE);
>> return rc;
>> }
>> @@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct cil_tree_node *current,
>> void *extra_args)
>> return SEPOL_OK;
>> exit:
>> + cil_list_destroy(&new, CIL_FALSE);
>> return rc;
>> }
>> @@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node
>> *current, void *extra_args
>> return SEPOL_OK;
>> exit:
>> + cil_list_destroy(&new, CIL_FALSE);
>> return rc;
>> }
>> @@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> rc = cil_fill_cats(pc, &catset->cats);
>> if (rc != SEPOL_OK) {
>> cil_destroy_catset(catset);
>> + cil_destroy_args(new_arg);
>> goto exit;
>> }
>> cil_tree_node_init(&cat_node);
>> @@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> if (rc != SEPOL_OK) {
>> cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n",
>> rc);
>> cil_destroy_level(level);
>> + cil_destroy_args(new_arg);
>> goto exit;
>> }
>> cil_tree_node_init(&lvl_node);
>> @@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> if (rc != SEPOL_OK) {
>> cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc:
>> %d\n", rc);
>> cil_destroy_levelrange(range);
>> + cil_destroy_args(new_arg);
>> goto exit;
>> }
>> cil_tree_node_init(&range_node);
>> @@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> if (rc != SEPOL_OK) {
>> cil_log(CIL_ERR, "Failed to create anonymous ip address, rc:
>> %d\n", rc);
>> cil_destroy_ipaddr(ipaddr);
>> + cil_destroy_args(new_arg);
>> goto exit;
>> }
>> cil_tree_node_init(&addr_node);
>> @@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> if (rc != SEPOL_OK) {
>> cil_log(CIL_ERR, "Failed to create anonymous classpermission\n");
>> cil_destroy_classpermission(cp);
>> + cil_destroy_args(new_arg);
>> goto exit;
>> }
>> cil_tree_node_init(&cp_node);
>> @@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>> default:
>> cil_log(CIL_ERR, "Unexpected flavor: %d\n", (((struct
>> cil_param*)item->data)->flavor));
>> + cil_destroy_args(new_arg);
>> rc = SEPOL_ERR;
>> goto exit;
>> }
>> diff --git a/libsepol/cil/src/cil_symtab.c b/libsepol/cil/src/cil_symtab.c
>> index 3769979b..2970b863 100644
>> --- a/libsepol/cil/src/cil_symtab.c
>> +++ b/libsepol/cil/src/cil_symtab.c
>> @@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab
>> *symtab,
>> ckey->key2 == curr->ckey->key2 &&
>> ckey->key3 == curr->ckey->key3 &&
>> ckey->key4 == curr->ckey->key4) {
>> + free(node);
>> return SEPOL_EEXIST;
>> }
>> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
>> index 6f1b235e..312d137b 100644
>> --- a/libsepol/src/expand.c
>> +++ b/libsepol/src/expand.c
>> @@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>> new_trans->name = strdup(cur_rule->name);
>> if (!new_trans->name) {
>> ERR(state->handle, "Out of memory!");
>> + free(new_trans);
>> return -1;
>> }
>> new_trans->stype = i + 1;
>> @@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>> otype = calloc(1, sizeof(*otype));
>> if (!otype) {
>> ERR(state->handle, "Out of memory!");
>> + free(new_trans->name);
>> + free(new_trans);
>> return -1;
>> }
>> otype->otype = mapped_otype;
>> @@ -1469,6 +1472,9 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>> otype);
>> if (rc) {
>> ERR(state->handle, "Out of memory!");
>> + free(otype);
>> + free(new_trans->name);
>> + free(new_trans);
>> return -1;
>> }
>> }
>> diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
>> index 63e4d489..ec82f597 100644
>> --- a/libsepol/src/kernel_to_cil.c
>> +++ b/libsepol/src/kernel_to_cil.c
>> @@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct
>> policydb *pdb, cond_av_li
>> return 0;
>> exit:
>> + strs_free_all(strs);
>> + strs_destroy(&strs);
>> return rc;
>> }
>> diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
>> index 215d940c..afadca6b 100644
>> --- a/libsepol/src/kernel_to_conf.c
>> +++ b/libsepol/src/kernel_to_conf.c
>> @@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct
>> policydb *pdb, cond_av_l
>> return 0;
>> exit:
>> + strs_free_all(strs);
>> + strs_destroy(&strs);
>> return rc;
>> }
prev parent reply other threads:[~2019-02-06 8:07 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-01 21:08 [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan James Carter
2019-02-04 17:44 ` Petr Lautrbach
2019-02-06 8:07 ` Petr Lautrbach [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=pjdpns5z6fm.fsf@redhat.com \
--to=plautrba@redhat.com \
--cc=jwcart2@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.