diff mbox series

[5/5] libsepol: avoid memory corruption on realloc failure

Message ID 20231109135315.44095-5-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit 541aab884591
Delegated to: Petr Lautrbach
Headers show
Series [1/5] semodule_link: avoid NULL dereference on OOM | expand

Commit Message

Christian Göttsche Nov. 9, 2023, 1:53 p.m. UTC 
Use a single pointer variable for the realloc(3) result to not
immediately override the source pointer.

Also don't unnecessarily copy the first character.

Reported by Clang Analyzer:

    services.c:810:14: warning: Assigned value is garbage or undefined [core.uninitialized.Assign]
      810 |                                         **r_buf = **new_buf;
          |                                                 ^ ~~~~~~~~~

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libsepol/src/services.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)
diff mbox series

Patch

diff --git a/libsepol/src/services.c b/libsepol/src/services.c
index 51bd56a0..738a3404 100644
--- a/libsepol/src/services.c
+++ b/libsepol/src/services.c
@@ -787,8 +787,8 @@  mls_ops:
 
 	if (r_buf && ((s[0] == 0) || ((s[0] == 1 &&
 				(flags & SHOW_GRANTED) == SHOW_GRANTED)))) {
-		int len, new_buf_len;
-		char *p, **new_buf = r_buf;
+		int len;
+		char *p;
 		/*
 		* These contain the constraint components that are added to the
 		* callers reason buffer.
@@ -801,13 +801,13 @@  mls_ops:
 				len = snprintf(p, reason_buf_len - reason_buf_used,
 						"%s", buffers[x]);
 				if (len < 0 || len >= reason_buf_len - reason_buf_used) {
-					new_buf_len = reason_buf_len + REASON_BUF_SIZE;
-					*new_buf = realloc(*r_buf, new_buf_len);
-					if (!*new_buf) {
+					int new_buf_len = reason_buf_len + REASON_BUF_SIZE;
+					char *new_buf = realloc(*r_buf, new_buf_len);
+					if (!new_buf) {
 						ERR(NULL, "failed to realloc reason buffer");
 						goto out1;
 					}
-					**r_buf = **new_buf;
+					*r_buf = new_buf;
 					reason_buf_len = new_buf_len;
 					continue;
 				} else {