libsepol-2.8-3

- Fix RESOURCE_LEAK coverity scan defects

libsepol-fedora.patch

@@ -0,0 +1,229 @@
+diff --git libsepol-2.8/cil/src/cil_binary.c libsepol-2.8/cil/src/cil_binary.c
+index 0cc6eeb..a645c95 100644
+--- libsepol-2.8/cil/src/cil_binary.c
++++ libsepol-2.8/cil/src/cil_binary.c
+@@ -912,6 +912,8 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias)
+ 	key = cil_strdup(cil_alias->datum.fqn);
+ 	rc = symtab_insert(pdb, SYM_LEVELS, key, sepol_alias, SCOPE_DECL, 0, NULL);
+ 	if (rc != SEPOL_OK) {
++		if (rc == 1)
++			free(sepol_alias);
+ 		goto exit;
+ 	}
+ 
+@@ -1763,11 +1765,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, uint32_t src, u
+ 		hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms));
+ 		rc = ebitmap_cpy(hashtab_xperms, xperms);
+ 		if (rc != SEPOL_OK) {
++			free(hashtab_xperms);
+ 			free(avtab_key);
+ 			goto exit;
+ 		}
+ 		rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms);
+ 		if (rc != SEPOL_OK) {
++			free(hashtab_xperms);
+ 			free(avtab_key);
+ 			goto exit;
+ 		}
+@@ -2157,6 +2161,7 @@ static int __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list
+ 			op->expr_type = COND_NEQ;
+ 			break;
+ 		default:
++			free(op);
+ 			goto exit;
+ 		}
+ 
+@@ -2283,6 +2288,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
+ 
+ 	cond_expr_destroy(tmp_cond->expr);
+ 	free(tmp_cond);
++	tmp_cond = NULL;
+ 
+ 	for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) {
+ 		if (cb_node->flavor == CIL_CONDBLOCK) {
+@@ -2327,6 +2333,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c
+ 	return SEPOL_OK;
+ 
+ exit:
++	if (tmp_cond) {
++		if (tmp_cond->expr)
++			cond_expr_destroy(tmp_cond->expr);
++		free(tmp_cond);
++	}
+ 	return rc;
+ }
+ 
+@@ -4797,6 +4808,7 @@ static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas
+ 	return cp_list;
+ 
+ exit:
++	free(cp);
+ 	cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol values\n");
+ 	return NULL;
+ }
+diff --git libsepol-2.8/cil/src/cil_resolve_ast.c libsepol-2.8/cil/src/cil_resolve_ast.c
+index 0225924..3ea070c 100644
+--- libsepol-2.8/cil/src/cil_resolve_ast.c
++++ libsepol-2.8/cil/src/cil_resolve_ast.c
+@@ -1522,6 +1522,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args)
+ 		rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, extra_args, &datum);
+ 		if (rc != SEPOL_OK) {
+ 			cil_log(CIL_ERR, "Failed to resolve sid %s in sidorder\n", (char *)curr->data);
++			free(new);
+ 			goto exit;
+ 		}
+ 		cil_list_append(new, CIL_SID, datum);
+@@ -1591,6 +1592,8 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args)
+ 	return SEPOL_OK;
+ 
+ exit:
++	if (new)
++		free(new);
+ 	return rc;
+ }
+ 
+@@ -1624,6 +1627,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args
+ 	return SEPOL_OK;
+ 
+ exit:
++	free(new);
+ 	return rc;
+ }
+ 
+@@ -2853,6 +2857,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 					rc = cil_fill_cats(pc, &catset->cats);
+ 					if (rc != SEPOL_OK) {
+ 						cil_destroy_catset(catset);
++						cil_destroy_args(new_arg);
+ 						goto exit;
+ 					}
+ 					cil_tree_node_init(&cat_node);
+@@ -2877,6 +2882,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 					if (rc != SEPOL_OK) {
+ 						cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc);
+ 						cil_destroy_level(level);
++						cil_destroy_args(new_arg);
+ 						goto exit;
+ 					}
+ 					cil_tree_node_init(&lvl_node);
+@@ -2901,6 +2907,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 					if (rc != SEPOL_OK) {
+ 						cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc);
+ 						cil_destroy_levelrange(range);
++						cil_destroy_args(new_arg);
+ 						goto exit;
+ 					}
+ 					cil_tree_node_init(&range_node);
+@@ -2925,6 +2932,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 					if (rc != SEPOL_OK) {
+ 						cil_log(CIL_ERR, "Failed to create anonymous ip address, rc; %d\n", rc);
+ 						cil_destroy_ipaddr(ipaddr);
++						cil_destroy_args(new_arg);
+ 						goto exit;
+ 					}
+ 					cil_tree_node_init(&addr_node);
+@@ -2955,6 +2963,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 					if (rc != SEPOL_OK) {
+ 						cil_log(CIL_ERR, "Failed to create anonymous classpermission\n");
+ 						cil_destroy_classpermission(cp);
++						cil_destroy_args(new_arg);
+ 						goto exit;
+ 					}
+ 					cil_tree_node_init(&cp_node);
+@@ -2970,6 +2979,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args)
+ 			default:
+ 				cil_log(CIL_ERR, "Unexpected flavor: %d\n", 
+ 						(((struct cil_param*)item->data)->flavor));
++				cil_destroy_args(new_arg);
+ 				rc = SEPOL_ERR;
+ 				goto exit;
+ 			}
+diff --git libsepol-2.8/cil/src/cil_symtab.c libsepol-2.8/cil/src/cil_symtab.c
+index 3769979..2970b86 100644
+--- libsepol-2.8/cil/src/cil_symtab.c
++++ libsepol-2.8/cil/src/cil_symtab.c
+@@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab *symtab,
+ 			ckey->key2 == curr->ckey->key2 &&
+ 			ckey->key3 == curr->ckey->key3 &&
+ 			ckey->key4 == curr->ckey->key4) {
++			free(node);
+ 			return SEPOL_EEXIST;
+ 		}
+ 
+diff --git libsepol-2.8/include/sepol/errcodes.h libsepol-2.8/include/sepol/errcodes.h
+index 0136564..6e9ff31 100644
+--- libsepol-2.8/include/sepol/errcodes.h
++++ libsepol-2.8/include/sepol/errcodes.h
+@@ -12,7 +12,7 @@ extern "C" {
+ #define SEPOL_OK             0
+ 
+ /* These first error codes are defined for compatibility with
+- * previous version of libsepol. In the future, custome error
++ * previous version of libsepol. In the future, custom error
+  * codes that don't map to system error codes should be defined
+  * outside of the range of system error codes.
+  */
+diff --git libsepol-2.8/src/expand.c libsepol-2.8/src/expand.c
+index 6f1b235..125a680 100644
+--- libsepol-2.8/src/expand.c
++++ libsepol-2.8/src/expand.c
+@@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				new_trans->name = strdup(cur_rule->name);
+ 				if (!new_trans->name) {
+ 					ERR(state->handle, "Out of memory!");
++					free(new_trans);
+ 					return -1;
+ 				}
+ 				new_trans->stype = i + 1;
+@@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r
+ 				otype = calloc(1, sizeof(*otype));
+ 				if (!otype) {
+ 					ERR(state->handle, "Out of memory!");
++					free(new_trans->name);
++					free(new_trans);
+ 					return -1;
+ 				}
+ 				otype->otype = mapped_otype;
+diff --git libsepol-2.8/src/kernel_to_cil.c libsepol-2.8/src/kernel_to_cil.c
+index b1eb66d..8d58e04 100644
+--- libsepol-2.8/src/kernel_to_cil.c
++++ libsepol-2.8/src/kernel_to_cil.c
+@@ -2019,6 +2019,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_li
+ 	return 0;
+ 
+ exit:
++	strs_free_all(strs);
++	strs_destroy(&strs);
+ 	return rc;
+ }
+ 
+diff --git libsepol-2.8/src/kernel_to_common.c libsepol-2.8/src/kernel_to_common.c
+index 342bc3c..19a8c0e 100644
+--- libsepol-2.8/src/kernel_to_common.c
++++ libsepol-2.8/src/kernel_to_common.c
+@@ -80,10 +80,12 @@ static char *create_str_helper(const char *fmt, int num, va_list vargs)
+ 		goto exit;
+ 	}
+ 
++	va_end(vargs2);
+ 	return str;
+ 
+ exit:
+ 	free(str);
++	va_end(vargs2);
+ 	return NULL;
+ }
+ 
+diff --git libsepol-2.8/src/kernel_to_conf.c libsepol-2.8/src/kernel_to_conf.c
+index 9540520..a74e6c4 100644
+--- libsepol-2.8/src/kernel_to_conf.c
++++ libsepol-2.8/src/kernel_to_conf.c
+@@ -1987,6 +1987,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct policydb *pdb, cond_av_l
+ 	return 0;
+ 
+ exit:
++	strs_free_all(strs);
++	strs_destroy(&strs);
+ 	return rc;
+ }
+ 

libsepol.spec

@@ -1,13 +1,13 @@
 Summary: SELinux binary policy manipulation library
 Name: libsepol
 Version: 2.8
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: LGPLv2+
 Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/libsepol-2.8.tar.gz
 # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh
 # run:
 # $ VERSION=2.8 ./make-fedora-selinux-patch.sh libsepol
-# HEAD https://github.com/fedora-selinux/selinux/commit/11eab8523bec5fcded6c336e3112f30f7931cba6
+# HEAD https://github.com/fedora-selinux/selinux/commit/decd49caec76a87817686f84716503151cf2be5d
 # Patch1: libsepol-fedora.patch
 URL: https://github.com/SELinuxProject/selinux/wiki
 BuildRequires: gcc
@@ -94,6 +94,9 @@ exit 0
 %{_libdir}/libsepol.so.1
 
 %changelog
+* Tue Nov 13 2018 Petr Lautrbach <plautrba@redhat.com> - 2.8-3
+- Fix RESOURCE_LEAK coverity scan defects
+
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild