SELinux Archive on lore.kernel.org
 help / Atom feed
* [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
@ 2019-02-01 21:08 James Carter
  2019-02-04 17:44 ` Petr Lautrbach
  0 siblings, 1 reply; 3+ messages in thread
From: James Carter @ 2019-02-01 21:08 UTC (permalink / raw)
  To: selinux

These were reported by Petr Lautrbach (plautrba@redhat.com) and this
patch was based on his patch with only a few changes.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
---
 libsepol/cil/src/cil_binary.c      | 13 ++++++++++++-
 libsepol/cil/src/cil_resolve_ast.c |  9 +++++++++
 libsepol/cil/src/cil_symtab.c      |  1 +
 libsepol/src/expand.c              |  6 ++++++
 libsepol/src/kernel_to_cil.c       |  2 ++
 libsepol/src/kernel_to_conf.c      |  2 ++
 6 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
index 0cc6eeb1..a10c3763 100644
--- a/libsepol/cil/src/cil_binary.c
+++ b/libsepol/cil/src/cil_binary.c
@@ -54,6 +54,7 @@
 #include "cil_binary.h"
 #include "cil_symtab.h"
 #include "cil_find.h"
+#include "cil_build_ast.h"
 
 /* There are 44000 filename_trans in current fedora policy. 1.33 times this is the recommended
  * size of a hashtable. The next power of 2 of this is 2 ** 16.
@@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias)
 
 exit:
 	level_datum_destroy(sepol_alias);
-	free(sepol_level);
+	free(sepol_alias);
 	free(key);
 	return rc;
 }
@@ -1763,11 +1764,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, uint32_t src, u
 		hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
 		rc = ebitmap_cpy(hashtab_xperms, xperms);
 		if (rc != SEPOL_OK) {
+			free(hashtab_xperms);
 			free(avtab_key);
 			goto exit;
 		}
 		rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms);
 		if (rc != SEPOL_OK) {
+			free(hashtab_xperms);
 			free(avtab_key);
 			goto exit;
 		}
@@ -2157,6 +2160,7 @@ static int __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list
 			op->expr_type = COND_NEQ;
 			break;
 		default:
+			free(op);
 			goto exit;
 		}
 
@@ -2283,6 +2287,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
 
 	cond_expr_destroy(tmp_cond->expr);
 	free(tmp_cond);
+	tmp_cond = NULL;
 
 	for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) {
 		if (cb_node->flavor == CIL_CONDBLOCK) {
@@ -2327,6 +2332,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
 	return SEPOL_OK;
 
 exit:
+	if (tmp_cond) {
+		if (tmp_cond->expr)
+			cond_expr_destroy(tmp_cond->expr);
+		free(tmp_cond);
+	}
 	return rc;
 }
 
@@ -4797,6 +4807,7 @@ static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
 	return cp_list;
 
 exit:
+	cil_destroy_classperms(cp);
 	cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol values\n");
 	return NULL;
 }
diff --git a/libsepol/cil/src/cil_resolve_ast.c b/libsepol/cil/src/cil_resolve_ast.c
index fb9d9174..ea08087d 100644
--- a/libsepol/cil/src/cil_resolve_ast.c
+++ b/libsepol/cil/src/cil_resolve_ast.c
@@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)
 	return SEPOL_OK;
 
 exit:
+	cil_list_destroy(&new, CIL_FALSE);
 	return rc;
 }
 
@@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)
 	return SEPOL_OK;
 
 exit:
+	cil_list_destroy(&new, CIL_FALSE);
 	return rc;
 }
 
@@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args
 	return SEPOL_OK;
 
 exit:
+	cil_list_destroy(&new, CIL_FALSE);
 	return rc;
 }
 
@@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 					rc = cil_fill_cats(pc, &catset->cats);
 					if (rc != SEPOL_OK) {
 						cil_destroy_catset(catset);
+						cil_destroy_args(new_arg);
 						goto exit;
 					}
 					cil_tree_node_init(&cat_node);
@@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 					if (rc != SEPOL_OK) {
 						cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc);
 						cil_destroy_level(level);
+						cil_destroy_args(new_arg);
 						goto exit;
 					}
 					cil_tree_node_init(&lvl_node);
@@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 					if (rc != SEPOL_OK) {
 						cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc);
 						cil_destroy_levelrange(range);
+						cil_destroy_args(new_arg);
 						goto exit;
 					}
 					cil_tree_node_init(&range_node);
@@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 					if (rc != SEPOL_OK) {
 						cil_log(CIL_ERR, "Failed to create anonymous ip address, rc: %d\n", rc);
 						cil_destroy_ipaddr(ipaddr);
+						cil_destroy_args(new_arg);
 						goto exit;
 					}
 					cil_tree_node_init(&addr_node);
@@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 					if (rc != SEPOL_OK) {
 						cil_log(CIL_ERR, "Failed to create anonymous classpermission\n");
 						cil_destroy_classpermission(cp);
+						cil_destroy_args(new_arg);
 						goto exit;
 					}
 					cil_tree_node_init(&cp_node);
@@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
 			default:
 				cil_log(CIL_ERR, "Unexpected flavor: %d\n", 
 						(((struct cil_param*)item->data)->flavor));
+				cil_destroy_args(new_arg);
 				rc = SEPOL_ERR;
 				goto exit;
 			}
diff --git a/libsepol/cil/src/cil_symtab.c b/libsepol/cil/src/cil_symtab.c
index 3769979b..2970b863 100644
--- a/libsepol/cil/src/cil_symtab.c
+++ b/libsepol/cil/src/cil_symtab.c
@@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab *symtab,
 			ckey->key2 == curr->ckey->key2 &&
 			ckey->key3 == curr->ckey->key3 &&
 			ckey->key4 == curr->ckey->key4) {
+			free(node);
 			return SEPOL_EEXIST;
 		}
 
diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
index 6f1b235e..312d137b 100644
--- a/libsepol/src/expand.c
+++ b/libsepol/src/expand.c
@@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
 				new_trans->name = strdup(cur_rule->name);
 				if (!new_trans->name) {
 					ERR(state->handle, "Out of memory!");
+					free(new_trans);
 					return -1;
 				}
 				new_trans->stype = i + 1;
@@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
 				otype = calloc(1, sizeof(*otype));
 				if (!otype) {
 					ERR(state->handle, "Out of memory!");
+					free(new_trans->name);
+					free(new_trans);
 					return -1;
 				}
 				otype->otype = mapped_otype;
@@ -1469,6 +1472,9 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
 						    otype);
 				if (rc) {
 					ERR(state->handle, "Out of memory!");
+					free(otype);
+					free(new_trans->name);
+					free(new_trans);
 					return -1;
 				}
 			}
diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
index 63e4d489..ec82f597 100644
--- a/libsepol/src/kernel_to_cil.c
+++ b/libsepol/src/kernel_to_cil.c
@@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_li
 	return 0;
 
 exit:
+	strs_free_all(strs);
+	strs_destroy(&strs);
 	return rc;
 }
 
diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
index 215d940c..afadca6b 100644
--- a/libsepol/src/kernel_to_conf.c
+++ b/libsepol/src/kernel_to_conf.c
@@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct policydb *pdb, cond_av_l
 	return 0;
 
 exit:
+	strs_free_all(strs);
+	strs_destroy(&strs);
 	return rc;
 }
 
-- 
2.20.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
  2019-02-01 21:08 [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan James Carter
@ 2019-02-04 17:44 ` Petr Lautrbach
  2019-02-06  8:07   ` Petr Lautrbach
  0 siblings, 1 reply; 3+ messages in thread
From: Petr Lautrbach @ 2019-02-04 17:44 UTC (permalink / raw)
  To: selinux; +Cc: James Carter


James Carter <jwcart2@tycho.nsa.gov> writes:

> These were reported by Petr Lautrbach (plautrba@redhat.com) and 
> this
> patch was based on his patch with only a few changes.
>
> Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>

The following list of Coverity scan defects are fixed by this 
patch
https://plautrba.fedorapeople.org/selinux/20190204-libsepol-fixed-RESOURCE_LEAK.txt

Thanks!

Acked-by: Petr Lautrbach <plautrba@redhat.com>

> ---
>  libsepol/cil/src/cil_binary.c      | 13 ++++++++++++-
>  libsepol/cil/src/cil_resolve_ast.c |  9 +++++++++
>  libsepol/cil/src/cil_symtab.c      |  1 +
>  libsepol/src/expand.c              |  6 ++++++
>  libsepol/src/kernel_to_cil.c       |  2 ++
>  libsepol/src/kernel_to_conf.c      |  2 ++
>  6 files changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/cil/src/cil_binary.c 
> b/libsepol/cil/src/cil_binary.c
> index 0cc6eeb1..a10c3763 100644
> --- a/libsepol/cil/src/cil_binary.c
> +++ b/libsepol/cil/src/cil_binary.c
> @@ -54,6 +54,7 @@
>  #include "cil_binary.h"
>  #include "cil_symtab.h"
>  #include "cil_find.h"
> +#include "cil_build_ast.h"
>  
>  /* There are 44000 filename_trans in current fedora policy. 
>  1.33 times this is the recommended
>   * size of a hashtable. The next power of 2 of this is 2 ** 16.
> @@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t 
> *pdb, struct cil_alias *cil_alias)
>  
>  exit:
>  	level_datum_destroy(sepol_alias);
> -	free(sepol_level);
> +	free(sepol_alias);
>  	free(key);
>  	return rc;
>  }
> @@ -1763,11 +1764,13 @@ int 
> __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, 
> uint32_t src, u
>  		hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
>  		rc = ebitmap_cpy(hashtab_xperms, xperms);
>  		if (rc != SEPOL_OK) {
> +			free(hashtab_xperms);
>  			free(avtab_key);
>  			goto exit;
>  		}
>  		rc = hashtab_insert(h, (hashtab_key_t)avtab_key, 
>  hashtab_xperms);
>  		if (rc != SEPOL_OK) {
> +			free(hashtab_xperms);
>  			free(avtab_key);
>  			goto exit;
>  		}
> @@ -2157,6 +2160,7 @@ static int 
> __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct 
> cil_list
>  			op->expr_type = COND_NEQ;
>  			break;
>  		default:
> +			free(op);
>  			goto exit;
>  		}
>  
> @@ -2283,6 +2287,7 @@ int cil_booleanif_to_policydb(policydb_t 
> *pdb, const struct cil_db *db, struct c
>  
>  	cond_expr_destroy(tmp_cond->expr);
>  	free(tmp_cond);
> +	tmp_cond = NULL;
>  
>  	for (cb_node = node->cl_head; cb_node != NULL; cb_node = 
>  cb_node->next) {
>  		if (cb_node->flavor == CIL_CONDBLOCK) {
> @@ -2327,6 +2332,11 @@ int cil_booleanif_to_policydb(policydb_t 
> *pdb, const struct cil_db *db, struct c
>  	return SEPOL_OK;
>  
>  exit:
> +	if (tmp_cond) {
> +		if (tmp_cond->expr)
> +			cond_expr_destroy(tmp_cond->expr);
> +		free(tmp_cond);
> +	}
>  	return rc;
>  }
>  
> @@ -4797,6 +4807,7 @@ static struct cil_list 
> *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
>  	return cp_list;
>  
>  exit:
> +	cil_destroy_classperms(cp);
>  	cil_log(CIL_ERR,"Failed to create CIL class-permissions from 
>  sepol values\n");
>  	return NULL;
>  }
> diff --git a/libsepol/cil/src/cil_resolve_ast.c 
> b/libsepol/cil/src/cil_resolve_ast.c
> index fb9d9174..ea08087d 100644
> --- a/libsepol/cil/src/cil_resolve_ast.c
> +++ b/libsepol/cil/src/cil_resolve_ast.c
> @@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct 
> cil_tree_node *current, void *extra_args)
>  	return SEPOL_OK;
>  
>  exit:
> +	cil_list_destroy(&new, CIL_FALSE);
>  	return rc;
>  }
>  
> @@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct 
> cil_tree_node *current, void *extra_args)
>  	return SEPOL_OK;
>  
>  exit:
> +	cil_list_destroy(&new, CIL_FALSE);
>  	return rc;
>  }
>  
> @@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct 
> cil_tree_node *current, void *extra_args
>  	return SEPOL_OK;
>  
>  exit:
> +	cil_list_destroy(&new, CIL_FALSE);
>  	return rc;
>  }
>  
> @@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  					rc = cil_fill_cats(pc, &catset->cats);
>  					if (rc != SEPOL_OK) {
>  						cil_destroy_catset(catset);
> +						cil_destroy_args(new_arg);
>  						goto exit;
>  					}
>  					cil_tree_node_init(&cat_node);
> @@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  					if (rc != SEPOL_OK) {
>  						cil_log(CIL_ERR, "Failed to create anonymous level, 
>  rc: %d\n", rc);
>  						cil_destroy_level(level);
> +						cil_destroy_args(new_arg);
>  						goto exit;
>  					}
>  					cil_tree_node_init(&lvl_node);
> @@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  					if (rc != SEPOL_OK) {
>  						cil_log(CIL_ERR, "Failed to create anonymous 
>  levelrange, rc: %d\n", rc);
>  						cil_destroy_levelrange(range);
> +						cil_destroy_args(new_arg);
>  						goto exit;
>  					}
>  					cil_tree_node_init(&range_node);
> @@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  					if (rc != SEPOL_OK) {
>  						cil_log(CIL_ERR, "Failed to create anonymous ip 
>  address, rc: %d\n", rc);
>  						cil_destroy_ipaddr(ipaddr);
> +						cil_destroy_args(new_arg);
>  						goto exit;
>  					}
>  					cil_tree_node_init(&addr_node);
> @@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  					if (rc != SEPOL_OK) {
>  						cil_log(CIL_ERR, "Failed to create anonymous 
>  classpermission\n");
>  						cil_destroy_classpermission(cp);
> +						cil_destroy_args(new_arg);
>  						goto exit;
>  					}
>  					cil_tree_node_init(&cp_node);
> @@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node 
> *current, void *extra_args)
>  			default:
>  				cil_log(CIL_ERR, "Unexpected flavor: %d\n", 
>  						(((struct cil_param*)item->data)->flavor));
> +				cil_destroy_args(new_arg);
>  				rc = SEPOL_ERR;
>  				goto exit;
>  			}
> diff --git a/libsepol/cil/src/cil_symtab.c 
> b/libsepol/cil/src/cil_symtab.c
> index 3769979b..2970b863 100644
> --- a/libsepol/cil/src/cil_symtab.c
> +++ b/libsepol/cil/src/cil_symtab.c
> @@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct 
> cil_complex_symtab *symtab,
>  			ckey->key2 == curr->ckey->key2 &&
>  			ckey->key3 == curr->ckey->key3 &&
>  			ckey->key4 == curr->ckey->key4) {
> +			free(node);
>  			return SEPOL_EEXIST;
>  		}
>  
> diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
> index 6f1b235e..312d137b 100644
> --- a/libsepol/src/expand.c
> +++ b/libsepol/src/expand.c
> @@ -1451,6 +1451,7 @@ static int 
> expand_filename_trans(expand_state_t *state, 
> filename_trans_rule_t *r
>  				new_trans->name = strdup(cur_rule->name);
>  				if (!new_trans->name) {
>  					ERR(state->handle, "Out of memory!");
> +					free(new_trans);
>  					return -1;
>  				}
>  				new_trans->stype = i + 1;
> @@ -1460,6 +1461,8 @@ static int 
> expand_filename_trans(expand_state_t *state, 
> filename_trans_rule_t *r
>  				otype = calloc(1, sizeof(*otype));
>  				if (!otype) {
>  					ERR(state->handle, "Out of memory!");
> +					free(new_trans->name);
> +					free(new_trans);
>  					return -1;
>  				}
>  				otype->otype = mapped_otype;
> @@ -1469,6 +1472,9 @@ static int 
> expand_filename_trans(expand_state_t *state, 
> filename_trans_rule_t *r
>  						    otype);
>  				if (rc) {
>  					ERR(state->handle, "Out of memory!");
> +					free(otype);
> +					free(new_trans->name);
> +					free(new_trans);
>  					return -1;
>  				}
>  			}
> diff --git a/libsepol/src/kernel_to_cil.c 
> b/libsepol/src/kernel_to_cil.c
> index 63e4d489..ec82f597 100644
> --- a/libsepol/src/kernel_to_cil.c
> +++ b/libsepol/src/kernel_to_cil.c
> @@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE 
> *out, struct policydb *pdb, cond_av_li
>  	return 0;
>  
>  exit:
> +	strs_free_all(strs);
> +	strs_destroy(&strs);
>  	return rc;
>  }
>  
> diff --git a/libsepol/src/kernel_to_conf.c 
> b/libsepol/src/kernel_to_conf.c
> index 215d940c..afadca6b 100644
> --- a/libsepol/src/kernel_to_conf.c
> +++ b/libsepol/src/kernel_to_conf.c
> @@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE 
> *out, struct policydb *pdb, cond_av_l
>  	return 0;
>  
>  exit:
> +	strs_free_all(strs);
> +	strs_destroy(&strs);
>  	return rc;
>  }


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan
  2019-02-04 17:44 ` Petr Lautrbach
@ 2019-02-06  8:07   ` Petr Lautrbach
  0 siblings, 0 replies; 3+ messages in thread
From: Petr Lautrbach @ 2019-02-06  8:07 UTC (permalink / raw)
  To: selinux; +Cc: James Carter

Petr Lautrbach <plautrba@redhat.com> writes:

> James Carter <jwcart2@tycho.nsa.gov> writes:
>
>> These were reported by Petr Lautrbach (plautrba@redhat.com) and this
>> patch was based on his patch with only a few changes.
>>
>> Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
>
> The following list of Coverity scan defects are fixed by this patch
> https://plautrba.fedorapeople.org/selinux/20190204-libsepol-fixed-RESOURCE_LEAK.txt
>
> Thanks!
>
> Acked-by: Petr Lautrbach <plautrba@redhat.com>

Merged.

>
>> ---
>>  libsepol/cil/src/cil_binary.c      | 13 ++++++++++++-
>>  libsepol/cil/src/cil_resolve_ast.c |  9 +++++++++
>>  libsepol/cil/src/cil_symtab.c      |  1 +
>>  libsepol/src/expand.c              |  6 ++++++
>>  libsepol/src/kernel_to_cil.c       |  2 ++
>>  libsepol/src/kernel_to_conf.c      |  2 ++
>>  6 files changed, 32 insertions(+), 1 deletion(-)
>>
>> diff --git a/libsepol/cil/src/cil_binary.c b/libsepol/cil/src/cil_binary.c
>> index 0cc6eeb1..a10c3763 100644
>> --- a/libsepol/cil/src/cil_binary.c
>> +++ b/libsepol/cil/src/cil_binary.c
>> @@ -54,6 +54,7 @@
>>  #include "cil_binary.h"
>>  #include "cil_symtab.h"
>>  #include "cil_find.h"
>> +#include "cil_build_ast.h"
>>   /* There are 44000 filename_trans in current fedora policy.  1.33 times this
>> is the recommended
>>   * size of a hashtable. The next power of 2 of this is 2 ** 16.
>> @@ -930,7 +931,7 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct
>> cil_alias *cil_alias)
>>   exit:
>>  	level_datum_destroy(sepol_alias);
>> -	free(sepol_level);
>> +	free(sepol_alias);
>>  	free(key);
>>  	return rc;
>>  }
>> @@ -1763,11 +1764,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h,
>> uint16_t kind, uint32_t src, u
>>  		hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
>>  		rc = ebitmap_cpy(hashtab_xperms, xperms);
>>  		if (rc != SEPOL_OK) {
>> +			free(hashtab_xperms);
>>  			free(avtab_key);
>>  			goto exit;
>>  		}
>>  		rc = hashtab_insert(h, (hashtab_key_t)avtab_key,  hashtab_xperms);
>>  		if (rc != SEPOL_OK) {
>> +			free(hashtab_xperms);
>>  			free(avtab_key);
>>  			goto exit;
>>  		}
>> @@ -2157,6 +2160,7 @@ static int
>> __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list
>>  			op->expr_type = COND_NEQ;
>>  			break;
>>  		default:
>> +			free(op);
>>  			goto exit;
>>  		}
>>  @@ -2283,6 +2287,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const
>> struct cil_db *db, struct c
>>   	cond_expr_destroy(tmp_cond->expr);
>>  	free(tmp_cond);
>> +	tmp_cond = NULL;
>>   	for (cb_node = node->cl_head; cb_node != NULL; cb_node =  cb_node->next) {
>>  		if (cb_node->flavor == CIL_CONDBLOCK) {
>> @@ -2327,6 +2332,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const
>> struct cil_db *db, struct c
>>  	return SEPOL_OK;
>>   exit:
>> +	if (tmp_cond) {
>> +		if (tmp_cond->expr)
>> +			cond_expr_destroy(tmp_cond->expr);
>> +		free(tmp_cond);
>> +	}
>>  	return rc;
>>  }
>>  @@ -4797,6 +4807,7 @@ static struct cil_list
>> *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
>>  	return cp_list;
>>   exit:
>> +	cil_destroy_classperms(cp);
>>  	cil_log(CIL_ERR,"Failed to create CIL class-permissions from  sepol
>> values\n");
>>  	return NULL;
>>  }
>> diff --git a/libsepol/cil/src/cil_resolve_ast.c
>> b/libsepol/cil/src/cil_resolve_ast.c
>> index fb9d9174..ea08087d 100644
>> --- a/libsepol/cil/src/cil_resolve_ast.c
>> +++ b/libsepol/cil/src/cil_resolve_ast.c
>> @@ -1535,6 +1535,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current,
>> void *extra_args)
>>  	return SEPOL_OK;
>>   exit:
>> +	cil_list_destroy(&new, CIL_FALSE);
>>  	return rc;
>>  }
>>  @@ -1591,6 +1592,7 @@ int cil_resolve_catorder(struct cil_tree_node *current,
>> void *extra_args)
>>  	return SEPOL_OK;
>>   exit:
>> +	cil_list_destroy(&new, CIL_FALSE);
>>  	return rc;
>>  }
>>  @@ -1624,6 +1626,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node
>> *current, void *extra_args
>>  	return SEPOL_OK;
>>   exit:
>> +	cil_list_destroy(&new, CIL_FALSE);
>>  	return rc;
>>  }
>>  @@ -2853,6 +2856,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  					rc = cil_fill_cats(pc, &catset->cats);
>>  					if (rc != SEPOL_OK) {
>>  						cil_destroy_catset(catset);
>> +						cil_destroy_args(new_arg);
>>  						goto exit;
>>  					}
>>  					cil_tree_node_init(&cat_node);
>> @@ -2877,6 +2881,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  					if (rc != SEPOL_OK) {
>>  						cil_log(CIL_ERR, "Failed to create anonymous level,  rc: %d\n",
>> rc);
>>  						cil_destroy_level(level);
>> +						cil_destroy_args(new_arg);
>>  						goto exit;
>>  					}
>>  					cil_tree_node_init(&lvl_node);
>> @@ -2901,6 +2906,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  					if (rc != SEPOL_OK) {
>>  						cil_log(CIL_ERR, "Failed to create anonymous  levelrange, rc:
>> %d\n", rc);
>>  						cil_destroy_levelrange(range);
>> +						cil_destroy_args(new_arg);
>>  						goto exit;
>>  					}
>>  					cil_tree_node_init(&range_node);
>> @@ -2925,6 +2931,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  					if (rc != SEPOL_OK) {
>>  						cil_log(CIL_ERR, "Failed to create anonymous ip  address, rc:
>> %d\n", rc);
>>  						cil_destroy_ipaddr(ipaddr);
>> +						cil_destroy_args(new_arg);
>>  						goto exit;
>>  					}
>>  					cil_tree_node_init(&addr_node);
>> @@ -2955,6 +2962,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  					if (rc != SEPOL_OK) {
>>  						cil_log(CIL_ERR, "Failed to create anonymous  classpermission\n");
>>  						cil_destroy_classpermission(cp);
>> +						cil_destroy_args(new_arg);
>>  						goto exit;
>>  					}
>>  					cil_tree_node_init(&cp_node);
>> @@ -2970,6 +2978,7 @@ int cil_resolve_call1(struct cil_tree_node *current,
>> void *extra_args)
>>  			default:
>>  				cil_log(CIL_ERR, "Unexpected flavor: %d\n",  						(((struct
>> cil_param*)item->data)->flavor));
>> +				cil_destroy_args(new_arg);
>>  				rc = SEPOL_ERR;
>>  				goto exit;
>>  			}
>> diff --git a/libsepol/cil/src/cil_symtab.c b/libsepol/cil/src/cil_symtab.c
>> index 3769979b..2970b863 100644
>> --- a/libsepol/cil/src/cil_symtab.c
>> +++ b/libsepol/cil/src/cil_symtab.c
>> @@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab
>> *symtab,
>>  			ckey->key2 == curr->ckey->key2 &&
>>  			ckey->key3 == curr->ckey->key3 &&
>>  			ckey->key4 == curr->ckey->key4) {
>> +			free(node);
>>  			return SEPOL_EEXIST;
>>  		}
>>  diff --git a/libsepol/src/expand.c b/libsepol/src/expand.c
>> index 6f1b235e..312d137b 100644
>> --- a/libsepol/src/expand.c
>> +++ b/libsepol/src/expand.c
>> @@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>>  				new_trans->name = strdup(cur_rule->name);
>>  				if (!new_trans->name) {
>>  					ERR(state->handle, "Out of memory!");
>> +					free(new_trans);
>>  					return -1;
>>  				}
>>  				new_trans->stype = i + 1;
>> @@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>>  				otype = calloc(1, sizeof(*otype));
>>  				if (!otype) {
>>  					ERR(state->handle, "Out of memory!");
>> +					free(new_trans->name);
>> +					free(new_trans);
>>  					return -1;
>>  				}
>>  				otype->otype = mapped_otype;
>> @@ -1469,6 +1472,9 @@ static int expand_filename_trans(expand_state_t *state,
>> filename_trans_rule_t *r
>>  						    otype);
>>  				if (rc) {
>>  					ERR(state->handle, "Out of memory!");
>> +					free(otype);
>> +					free(new_trans->name);
>> +					free(new_trans);
>>  					return -1;
>>  				}
>>  			}
>> diff --git a/libsepol/src/kernel_to_cil.c b/libsepol/src/kernel_to_cil.c
>> index 63e4d489..ec82f597 100644
>> --- a/libsepol/src/kernel_to_cil.c
>> +++ b/libsepol/src/kernel_to_cil.c
>> @@ -2031,6 +2031,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct
>> policydb *pdb, cond_av_li
>>  	return 0;
>>   exit:
>> +	strs_free_all(strs);
>> +	strs_destroy(&strs);
>>  	return rc;
>>  }
>>  diff --git a/libsepol/src/kernel_to_conf.c b/libsepol/src/kernel_to_conf.c
>> index 215d940c..afadca6b 100644
>> --- a/libsepol/src/kernel_to_conf.c
>> +++ b/libsepol/src/kernel_to_conf.c
>> @@ -1999,6 +1999,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct
>> policydb *pdb, cond_av_l
>>  	return 0;
>>   exit:
>> +	strs_free_all(strs);
>> +	strs_destroy(&strs);
>>  	return rc;
>>  }

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-01 21:08 [PATCH] libsepol: Fix RESOURCE_LEAK defects reported by coverity scan James Carter
2019-02-04 17:44 ` Petr Lautrbach
2019-02-06  8:07   ` Petr Lautrbach

SELinux Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/selinux/0 selinux/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 selinux selinux/ https://lore.kernel.org/selinux \
		selinux@vger.kernel.org selinux@archiver.kernel.org
	public-inbox-index selinux


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.selinux


AGPL code for this site: git clone https://public-inbox.org/ public-inbox