• Chad Sellers's avatar
    SELinux: Bug fix in polidydb_destroy · 6e8c751e
    Chad Sellers authored
    This patch fixes two bugs in policydb_destroy. Two list pointers
    (policydb.ocontexts[i] and policydb.genfs) were not being reset to NULL when
    the lists they pointed to were being freed. This caused a problem when the
    initial policy load failed, as the policydb being destroyed was not a
    temporary new policydb that was thrown away, but rather was the global
    (active) policydb. Consequently, later functions, particularly
    sys_bind->selinux_socket_bind->security_node_sid and
    do_rw_proc->selinux_sysctl->selinux_proc_get_sid->security_genfs_sid tried
    to dereference memory that had previously been freed.
    Signed-off-by: default avatarChad Sellers <csellers@tresys.com>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    6e8c751e
policydb.c 38.1 KB