SELinux Archive on lore.kernel.org
 help / Atom feed
* [PATCH 1/1] libsepol/cil: silence static analyser's use-after-free warning
@ 2019-02-06 21:07 Nicolas Iooss
  2019-02-11 19:06 ` [Non-DoD Source] " jwcart2
  0 siblings, 1 reply; 3+ messages in thread
From: Nicolas Iooss @ 2019-02-06 21:07 UTC (permalink / raw)
  To: selinux

clang's static analyze reports a use-after-free in
__cil_expr_to_string(), when __cil_expr_to_string_helper() does not
modify its third parameter (variable s1 here) in this loop:

    for (curr = curr->next; curr; curr = curr->next) {
        __cil_expr_to_string_helper(curr, flavor, &s1);
        cil_asprintf(&c2, "%s %s", c1, s1);
        free(c1);
        free(s1);
        c1 = c2;
    }

Silence this warning by making sure s1 is always NULL at the beginning
of every iteration of the loop.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
 libsepol/cil/src/cil_binary.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
index a10c3763bea4..e2eb3ebe8ff3 100644
--- a/libsepol/cil/src/cil_binary.c
+++ b/libsepol/cil/src/cil_binary.c
@@ -2075,6 +2075,7 @@ static void __cil_expr_to_string(struct cil_list *expr, enum cil_flavor flavor,
 		char *c2 = NULL;
 		__cil_expr_to_string_helper(curr, flavor, &c1);
 		for (curr = curr->next; curr; curr = curr->next) {
+			s1 = NULL;
 			__cil_expr_to_string_helper(curr, flavor, &s1);
 			cil_asprintf(&c2, "%s %s", c1, s1);
 			free(c1);
-- 
2.20.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [Non-DoD Source] [PATCH 1/1] libsepol/cil: silence static analyser's use-after-free warning
  2019-02-06 21:07 [PATCH 1/1] libsepol/cil: silence static analyser's use-after-free warning Nicolas Iooss
@ 2019-02-11 19:06 ` " jwcart2
  2019-02-12 21:01   ` Nicolas Iooss
  0 siblings, 1 reply; 3+ messages in thread
From: jwcart2 @ 2019-02-11 19:06 UTC (permalink / raw)
  To: Nicolas Iooss, selinux

On 2/6/19 4:07 PM, Nicolas Iooss wrote:
> clang's static analyze reports a use-after-free in
> __cil_expr_to_string(), when __cil_expr_to_string_helper() does not
> modify its third parameter (variable s1 here) in this loop:
> 
>      for (curr = curr->next; curr; curr = curr->next) {
>          __cil_expr_to_string_helper(curr, flavor, &s1);
>          cil_asprintf(&c2, "%s %s", c1, s1);
>          free(c1);
>          free(s1);
>          c1 = c2;
>      }
> 
> Silence this warning by making sure s1 is always NULL at the beginning
> of every iteration of the loop.
> 
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>

Acked-by: James Carter <jwcart2@tycho.nsa.gov>

> ---
>   libsepol/cil/src/cil_binary.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
> index a10c3763bea4..e2eb3ebe8ff3 100644
> --- a/libsepol/cil/src/cil_binary.c
> +++ b/libsepol/cil/src/cil_binary.c
> @@ -2075,6 +2075,7 @@ static void __cil_expr_to_string(struct cil_list *expr, enum cil_flavor flavor,
>   		char *c2 = NULL;
>   		__cil_expr_to_string_helper(curr, flavor, &c1);
>   		for (curr = curr->next; curr; curr = curr->next) {
> +			s1 = NULL;
>   			__cil_expr_to_string_helper(curr, flavor, &s1);
>   			cil_asprintf(&c2, "%s %s", c1, s1);
>   			free(c1);
> 


-- 
James Carter <jwcart2@tycho.nsa.gov>
National Security Agency

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [Non-DoD Source] [PATCH 1/1] libsepol/cil: silence static analyser's use-after-free warning
  2019-02-11 19:06 ` [Non-DoD Source] " jwcart2
@ 2019-02-12 21:01   ` Nicolas Iooss
  0 siblings, 0 replies; 3+ messages in thread
From: Nicolas Iooss @ 2019-02-12 21:01 UTC (permalink / raw)
  To: jwcart2; +Cc: selinux

On Mon, Feb 11, 2019 at 8:06 PM jwcart2 <jwcart2@tycho.nsa.gov> wrote:
>
> On 2/6/19 4:07 PM, Nicolas Iooss wrote:
> > clang's static analyze reports a use-after-free in
> > __cil_expr_to_string(), when __cil_expr_to_string_helper() does not
> > modify its third parameter (variable s1 here) in this loop:
> >
> >      for (curr = curr->next; curr; curr = curr->next) {
> >          __cil_expr_to_string_helper(curr, flavor, &s1);
> >          cil_asprintf(&c2, "%s %s", c1, s1);
> >          free(c1);
> >          free(s1);
> >          c1 = c2;
> >      }
> >
> > Silence this warning by making sure s1 is always NULL at the beginning
> > of every iteration of the loop.
> >
> > Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
>
> Acked-by: James Carter <jwcart2@tycho.nsa.gov>

Merged.

Nicolas

> > ---
> >   libsepol/cil/src/cil_binary.c | 1 +
> >   1 file changed, 1 insertion(+)
> >
> > diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
> > index a10c3763bea4..e2eb3ebe8ff3 100644
> > --- a/libsepol/cil/src/cil_binary.c
> > +++ b/libsepol/cil/src/cil_binary.c
> > @@ -2075,6 +2075,7 @@ static void __cil_expr_to_string(struct cil_list *expr, enum cil_flavor flavor,
> >               char *c2 = NULL;
> >               __cil_expr_to_string_helper(curr, flavor, &c1);
> >               for (curr = curr->next; curr; curr = curr->next) {
> > +                     s1 = NULL;
> >                       __cil_expr_to_string_helper(curr, flavor, &s1);
> >                       cil_asprintf(&c2, "%s %s", c1, s1);
> >                       free(c1);
> >
>
>
> --
> James Carter <jwcart2@tycho.nsa.gov>
> National Security Agency


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-06 21:07 [PATCH 1/1] libsepol/cil: silence static analyser's use-after-free warning Nicolas Iooss
2019-02-11 19:06 ` [Non-DoD Source] " jwcart2
2019-02-12 21:01   ` Nicolas Iooss

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox