Re: [PATCH 1/3] libsemanage: Fix USE_AFTER_FREE (CWE-672) in semanage_direct_get_module_info()

[Petr Lautrbach <plautrba@redhat.com>]

James Carter <jwcart2@gmail.com> writes:

> On Fri, Apr 1, 2022 at 11:54 AM Petr Lautrbach <plautrba@redhat.com> wrote:
>>
>> >From fclose(3):
>> Upon successful completion, 0 is returned.  Otherwise, EOF is returned
>> and errno is set to indicate the error. In either case, any further
>> access (including another call to fclose()) to the stream results in
>> undefined behavior.
>>
>> Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
>
> For all three patches:
> Acked-by: James Carter <jwcart2@gmail.com>

Merged, thanks!


>
>> ---
>>  libsemanage/src/direct_api.c | 1 +
>>  1 file changed, 1 insertion(+)
>>
>> diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c
>> index d83941b05ca1..d5716ce579e9 100644
>> --- a/libsemanage/src/direct_api.c
>> +++ b/libsemanage/src/direct_api.c
>> @@ -2293,6 +2293,7 @@ static int semanage_direct_get_module_info(semanage_handle_t *sh,
>>         tmp = NULL;
>>
>>         if (fclose(fp) != 0) {
>> +               fp = NULL;
>>                 ERR(sh,
>>                     "Unable to close %s module lang ext file.",
>>                     (*modinfo)->name);
>> --
>> 2.35.1
>>