diff mbox series

[05/15] checkpolicy: check allocation and free memory on error at type definition

Message ID 20240122135507.63506-5-cgzones@googlemail.com (mailing list archive)
State Accepted
Commit 770ad3ecac91
Delegated to: Petr Lautrbach
Headers show
Series [01/15] checkpolicy: add libfuzz based fuzzer | expand

Commit Message

Christian Göttsche Jan. 22, 2024, 1:54 p.m. UTC
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 checkpolicy/policy_define.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

Comments

James Carter Feb. 13, 2024, 8:35 p.m. UTC | #1
On Mon, Jan 22, 2024 at 9:37 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  checkpolicy/policy_define.c | 23 +++++++++++++++++------
>  1 file changed, 17 insertions(+), 6 deletions(-)
>
> diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> index 053156df..ec19da9d 100644
> --- a/checkpolicy/policy_define.c
> +++ b/checkpolicy/policy_define.c
> @@ -1399,7 +1399,7 @@ int define_typeattribute(void)
>         return 0;
>  }
>
> -static int define_typebounds_helper(char *bounds_id, char *type_id)
> +static int define_typebounds_helper(const char *bounds_id, const char *type_id)
>  {
>         type_datum_t *bounds, *type;
>
> @@ -1482,15 +1482,26 @@ int define_type(int alias)
>                  * old name based hierarchy.
>                  */
>                 if ((id = queue_remove(id_queue))) {
> -                       char *bounds, *delim;
> +                       const char *delim;
> +
> +                       if ((delim = strrchr(id, '.'))) {
> +                               int ret;
> +                               char *bounds = strdup(id);
> +                               if (!bounds) {
> +                                       yyerror("out of memory");
> +                                       free(id);
> +                                       return -1;
> +                               }
>
> -                       if ((delim = strrchr(id, '.'))
> -                           && (bounds = strdup(id))) {
>                                 bounds[(size_t)(delim - id)] = '\0';
>
> -                               if (define_typebounds_helper(bounds, id))
> -                                       return -1;
> +                               ret = define_typebounds_helper(bounds, id);
>                                 free(bounds);
> +                               if (ret) {
> +                                       free(id);
> +                                       return -1;
> +                               }
> +
>                         }
>                         free(id);
>                 }
> --
> 2.43.0
>
>
James Carter March 4, 2024, 7:18 p.m. UTC | #2
On Tue, Feb 13, 2024 at 3:35 PM James Carter <jwcart2@gmail.com> wrote:
>
> On Mon, Jan 22, 2024 at 9:37 AM Christian Göttsche
> <cgzones@googlemail.com> wrote:
> >
> > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>
>
Merged.
Thanks,
Jim

> > ---
> >  checkpolicy/policy_define.c | 23 +++++++++++++++++------
> >  1 file changed, 17 insertions(+), 6 deletions(-)
> >
> > diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
> > index 053156df..ec19da9d 100644
> > --- a/checkpolicy/policy_define.c
> > +++ b/checkpolicy/policy_define.c
> > @@ -1399,7 +1399,7 @@ int define_typeattribute(void)
> >         return 0;
> >  }
> >
> > -static int define_typebounds_helper(char *bounds_id, char *type_id)
> > +static int define_typebounds_helper(const char *bounds_id, const char *type_id)
> >  {
> >         type_datum_t *bounds, *type;
> >
> > @@ -1482,15 +1482,26 @@ int define_type(int alias)
> >                  * old name based hierarchy.
> >                  */
> >                 if ((id = queue_remove(id_queue))) {
> > -                       char *bounds, *delim;
> > +                       const char *delim;
> > +
> > +                       if ((delim = strrchr(id, '.'))) {
> > +                               int ret;
> > +                               char *bounds = strdup(id);
> > +                               if (!bounds) {
> > +                                       yyerror("out of memory");
> > +                                       free(id);
> > +                                       return -1;
> > +                               }
> >
> > -                       if ((delim = strrchr(id, '.'))
> > -                           && (bounds = strdup(id))) {
> >                                 bounds[(size_t)(delim - id)] = '\0';
> >
> > -                               if (define_typebounds_helper(bounds, id))
> > -                                       return -1;
> > +                               ret = define_typebounds_helper(bounds, id);
> >                                 free(bounds);
> > +                               if (ret) {
> > +                                       free(id);
> > +                                       return -1;
> > +                               }
> > +
> >                         }
> >                         free(id);
> >                 }
> > --
> > 2.43.0
> >
> >
diff mbox series

Patch

diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 053156df..ec19da9d 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -1399,7 +1399,7 @@  int define_typeattribute(void)
 	return 0;
 }
 
-static int define_typebounds_helper(char *bounds_id, char *type_id)
+static int define_typebounds_helper(const char *bounds_id, const char *type_id)
 {
 	type_datum_t *bounds, *type;
 
@@ -1482,15 +1482,26 @@  int define_type(int alias)
 		 * old name based hierarchy.
 		 */
 		if ((id = queue_remove(id_queue))) {
-			char *bounds, *delim;
+			const char *delim;
+
+			if ((delim = strrchr(id, '.'))) {
+				int ret;
+				char *bounds = strdup(id);
+				if (!bounds) {
+					yyerror("out of memory");
+					free(id);
+					return -1;
+				}
 
-			if ((delim = strrchr(id, '.'))
-			    && (bounds = strdup(id))) {
 				bounds[(size_t)(delim - id)] = '\0';
 
-				if (define_typebounds_helper(bounds, id))
-					return -1;
+				ret = define_typebounds_helper(bounds, id);
 				free(bounds);
+				if (ret) {
+					free(id);
+					return -1;
+				}
+
 			}
 			free(id);
 		}