diff mbox

[1/7] libsepol: do not dereference a NULL pointer when stack_init() fails

Message ID 20170328214152.17545-1-nicolas.iooss@m4x.org (mailing list archive)
State Not Applicable
Headers show

Commit Message

Nicolas Iooss March 28, 2017, 9:41 p.m. UTC 
In cond_expr_to_cil() when stack_init(&stack) fails, stack is set to
NULL and the execution flow jumps to label "exit". This triggers a call
to stack_pop(stack) which dereferences a NULL pointer in "if (stack->pos
== -1)".

This issue has been found using clang's static analyzer.

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
---
 libsepol/src/module_to_cil.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

Comments

James Carter March 29, 2017, 6:02 p.m. UTC | #1 
On 03/28/2017 05:41 PM, Nicolas Iooss wrote:
> In cond_expr_to_cil() when stack_init(&stack) fails, stack is set to
> NULL and the execution flow jumps to label "exit". This triggers a call
> to stack_pop(stack) which dereferences a NULL pointer in "if (stack->pos
> == -1)".
>
> This issue has been found using clang's static analyzer.
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>

I applied these seven patches.

Thanks,
Jim

> ---
>  libsepol/src/module_to_cil.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
> index 308ada4f1381..5c98c29bcf13 100644
> --- a/libsepol/src/module_to_cil.c
> +++ b/libsepol/src/module_to_cil.c
> @@ -1363,11 +1363,12 @@ exit:
>  	free(new_val);
>  	free(val1);
>  	free(val2);
> -	while ((val1 = stack_pop(stack)) != NULL) {
> -		free(val1);
> +	if (stack != NULL) {
> +		while ((val1 = stack_pop(stack)) != NULL) {
> +			free(val1);
> +		}
> +		stack_destroy(&stack);
>  	}
> -	stack_destroy(&stack);
> -
>  	return rc;
>  }
>
>
diff mbox

Patch

diff --git a/libsepol/src/module_to_cil.c b/libsepol/src/module_to_cil.c
index 308ada4f1381..5c98c29bcf13 100644
--- a/libsepol/src/module_to_cil.c
+++ b/libsepol/src/module_to_cil.c
@@ -1363,11 +1363,12 @@  exit:
 	free(new_val);
 	free(val1);
 	free(val2);
-	while ((val1 = stack_pop(stack)) != NULL) {
-		free(val1);
+	if (stack != NULL) {
+		while ((val1 = stack_pop(stack)) != NULL) {
+			free(val1);
+		}
+		stack_destroy(&stack);
 	}
-	stack_destroy(&stack);
-
 	return rc;
 }