forked from luck/tmp_suning_uos_patched
0256b0aa80
There are a few bugs in the error handling for security_load_policy().
1) If the newpolicy->sidtab allocation fails then it leads to a NULL
dereference. Also the error code was not set to -ENOMEM on that
path.
2) If policydb_read() failed then we call policydb_destroy() twice
which meands we call kvfree(p->sym_val_to_name[i]) twice.
3) If policydb_load_isids() failed then we call sidtab_destroy() twice
and that results in a double free in the sidtab_destroy_tree()
function because entry.ptr_inner and entry.ptr_leaf are not set to
NULL.
One thing that makes this code nice to deal with is that none of the
functions return partially allocated data. In other words, the
policydb_read() either allocates everything successfully or it frees
all the data it allocates. It never returns a mix of allocated and
not allocated data.
I re-wrote this to only free the successfully allocated data which
avoids the double frees. I also re-ordered selinux_policy_free() so
it's in the reverse order of the allocation function.
Fixes:
|
||
|---|---|---|
| .. | ||
| avtab.c | ||
| avtab.h | ||
| conditional.c | ||
| conditional.h | ||
| constraint.h | ||
| context.c | ||
| context.h | ||
| ebitmap.c | ||
| ebitmap.h | ||
| hashtab.c | ||
| hashtab.h | ||
| mls_types.h | ||
| mls.c | ||
| mls.h | ||
| policydb.c | ||
| policydb.h | ||
| services.c | ||
| services.h | ||
| sidtab.c | ||
| sidtab.h | ||
| symtab.c | ||
| symtab.h | ||