| Message ID | 20210728092135.132957-1-plautrba@redhat.com (mailing list archive) |
|---|---|
| State | Accepted |
| Headers | show |
| Series | libsemanage: Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext() | expand |
On Wed, Jul 28, 2021 at 5:22 AM Petr Lautrbach <plautrba@redhat.com> wrote: > > From fclose(3): > Upon successful completion, 0 is returned. Otherwise, EOF is returned > and errno is set to indicate the error. In either case, any further > access (including another call to fclose()) to the stream results in > undefined behavior. > > Fixes: > Error: USE_AFTER_FREE (CWE-672): [#def1] > libsemanage-3.2/src/direct_api.c:1023: freed_arg: "fclose" frees "fp". > libsemanage-3.2/src/direct_api.c:1034: use_closed_file: Calling "fclose" uses file handle "fp" after closing it. > # 1032| > # 1033| cleanup: > # 1034|-> if (fp != NULL) fclose(fp); > # 1035| > # 1036| return ret; > > Signed-off-by: Petr Lautrbach <plautrba@redhat.com> Acked-by: James Carter <jwcart2@gmail.com> > --- > libsemanage/src/direct_api.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c > index 9a4e79385b69..f0e2300a2f58 100644 > --- a/libsemanage/src/direct_api.c > +++ b/libsemanage/src/direct_api.c > @@ -1022,6 +1022,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh, > > if (fclose(fp) != 0) { > ERR(sh, "Unable to close %s module ext file.", modinfo->name); > + fp = NULL; > ret = -1; > goto cleanup; > } > -- > 2.32.0 >
On Wed, Jul 28, 2021 at 4:43 PM James Carter <jwcart2@gmail.com> wrote: > > On Wed, Jul 28, 2021 at 5:22 AM Petr Lautrbach <plautrba@redhat.com> wrote: > > > > From fclose(3): > > Upon successful completion, 0 is returned. Otherwise, EOF is returned > > and errno is set to indicate the error. In either case, any further > > access (including another call to fclose()) to the stream results in > > undefined behavior. > > > > Fixes: > > Error: USE_AFTER_FREE (CWE-672): [#def1] > > libsemanage-3.2/src/direct_api.c:1023: freed_arg: "fclose" frees "fp". > > libsemanage-3.2/src/direct_api.c:1034: use_closed_file: Calling "fclose" uses file handle "fp" after closing it. > > # 1032| > > # 1033| cleanup: > > # 1034|-> if (fp != NULL) fclose(fp); > > # 1035| > > # 1036| return ret; > > > > Signed-off-by: Petr Lautrbach <plautrba@redhat.com> > > Acked-by: James Carter <jwcart2@gmail.com> > Merged. Thanks, Jim > > --- > > libsemanage/src/direct_api.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c > > index 9a4e79385b69..f0e2300a2f58 100644 > > --- a/libsemanage/src/direct_api.c > > +++ b/libsemanage/src/direct_api.c > > @@ -1022,6 +1022,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh, > > > > if (fclose(fp) != 0) { > > ERR(sh, "Unable to close %s module ext file.", modinfo->name); > > + fp = NULL; > > ret = -1; > > goto cleanup; > > } > > -- > > 2.32.0 > >
diff --git a/libsemanage/src/direct_api.c b/libsemanage/src/direct_api.c index 9a4e79385b69..f0e2300a2f58 100644 --- a/libsemanage/src/direct_api.c +++ b/libsemanage/src/direct_api.c @@ -1022,6 +1022,7 @@ static int semanage_direct_write_langext(semanage_handle_t *sh, if (fclose(fp) != 0) { ERR(sh, "Unable to close %s module ext file.", modinfo->name); + fp = NULL; ret = -1; goto cleanup; }
From fclose(3): Upon successful completion, 0 is returned. Otherwise, EOF is returned and errno is set to indicate the error. In either case, any further access (including another call to fclose()) to the stream results in undefined behavior. Fixes: Error: USE_AFTER_FREE (CWE-672): [#def1] libsemanage-3.2/src/direct_api.c:1023: freed_arg: "fclose" frees "fp". libsemanage-3.2/src/direct_api.c:1034: use_closed_file: Calling "fclose" uses file handle "fp" after closing it. # 1032| # 1033| cleanup: # 1034|-> if (fp != NULL) fclose(fp); # 1035| # 1036| return ret; Signed-off-by: Petr Lautrbach <plautrba@redhat.com> --- libsemanage/src/direct_api.c | 1 + 1 file changed, 1 insertion(+)