Commit af15f14c authored by Ondrej Mosnacek's avatar Ondrej Mosnacek Committed by Paul Moore

selinux: free str on error in str_read()

In [see "Fixes:"] I missed the fact that str_read() may give back an
allocated pointer even if it returns an error, causing a potential
memory leak in filename_trans_read_one(). Fix this by making the
function free the allocated string whenever it returns a non-zero value,
which also makes its behavior more obvious and prevents repeating the
same mistake in the future.
Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1461665 ("Resource leaks")
Fixes: c3a27611 ("selinux: optimize storage of filename transitions")
Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent c753924b
...@@ -1035,14 +1035,14 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len) ...@@ -1035,14 +1035,14 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
if (!str) if (!str)
return -ENOMEM; return -ENOMEM;
/* it's expected the caller should free the str */
*strp = str;
rc = next_entry(str, fp, len); rc = next_entry(str, fp, len);
if (rc) if (rc) {
kfree(str);
return rc; return rc;
}
str[len] = '\0'; str[len] = '\0';
*strp = str;
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment