From 20bb12ceb90e60fedc459be279b6c98d4314a66b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 13 Nov 2018 10:23:27 +0100 Subject: [PATCH] libsepol-2.8-3 - Fix RESOURCE_LEAK coverity scan defects --- libsepol-fedora.patch | 229 ++++++++++++++++++++++++++++++++++++++++++ libsepol.spec | 7 +- 2 files changed, 234 insertions(+), 2 deletions(-) diff --git a/libsepol-fedora.patch b/libsepol-fedora.patch index e69de29..40f0ccc 100644 --- a/libsepol-fedora.patch +++ b/libsepol-fedora.patch @@ -0,0 +1,229 @@ +diff --git libsepol-2.8/cil/src/cil_binary.c libsepol-2.8/cil/src/cil_binary.c +index 0cc6eeb..a645c95 100644 +--- libsepol-2.8/cil/src/cil_binary.c ++++ libsepol-2.8/cil/src/cil_binary.c +@@ -912,6 +912,8 @@ int cil_sensalias_to_policydb(policydb_t *pdb, struct cil_alias *cil_alias) + key = cil_strdup(cil_alias->datum.fqn); + rc = symtab_insert(pdb, SYM_LEVELS, key, sepol_alias, SCOPE_DECL, 0, NULL); + if (rc != SEPOL_OK) { ++ if (rc == 1) ++ free(sepol_alias); + goto exit; + } + +@@ -1763,11 +1765,13 @@ int __cil_avrulex_ioctl_to_hashtable(hashtab_t h, uint16_t kind, uint32_t src, u + hashtab_xperms = cil_malloc(sizeof(*hashtab_xperms)); + rc = ebitmap_cpy(hashtab_xperms, xperms); + if (rc != SEPOL_OK) { ++ free(hashtab_xperms); + free(avtab_key); + goto exit; + } + rc = hashtab_insert(h, (hashtab_key_t)avtab_key, hashtab_xperms); + if (rc != SEPOL_OK) { ++ free(hashtab_xperms); + free(avtab_key); + goto exit; + } +@@ -2157,6 +2161,7 @@ static int __cil_cond_expr_to_sepol_expr_helper(policydb_t *pdb, struct cil_list + op->expr_type = COND_NEQ; + break; + default: ++ free(op); + goto exit; + } + +@@ -2283,6 +2288,7 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c + + cond_expr_destroy(tmp_cond->expr); + free(tmp_cond); ++ tmp_cond = NULL; + + for (cb_node = node->cl_head; cb_node != NULL; cb_node = cb_node->next) { + if (cb_node->flavor == CIL_CONDBLOCK) { +@@ -2327,6 +2333,11 @@ int cil_booleanif_to_policydb(policydb_t *pdb, const struct cil_db *db, struct c + return SEPOL_OK; + + exit: ++ if (tmp_cond) { ++ if (tmp_cond->expr) ++ cond_expr_destroy(tmp_cond->expr); ++ free(tmp_cond); ++ } + return rc; + } + +@@ -4797,6 +4808,7 @@ static struct cil_list *cil_classperms_from_sepol(policydb_t *pdb, uint16_t clas + return cp_list; + + exit: ++ free(cp); + cil_log(CIL_ERR,"Failed to create CIL class-permissions from sepol values\n"); + return NULL; + } +diff --git libsepol-2.8/cil/src/cil_resolve_ast.c libsepol-2.8/cil/src/cil_resolve_ast.c +index 0225924..3ea070c 100644 +--- libsepol-2.8/cil/src/cil_resolve_ast.c ++++ libsepol-2.8/cil/src/cil_resolve_ast.c +@@ -1522,6 +1522,7 @@ int cil_resolve_sidorder(struct cil_tree_node *current, void *extra_args) + rc = cil_resolve_name(current, (char *)curr->data, CIL_SYM_SIDS, extra_args, &datum); + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to resolve sid %s in sidorder\n", (char *)curr->data); ++ free(new); + goto exit; + } + cil_list_append(new, CIL_SID, datum); +@@ -1591,6 +1592,8 @@ int cil_resolve_catorder(struct cil_tree_node *current, void *extra_args) + return SEPOL_OK; + + exit: ++ if (new) ++ free(new); + return rc; + } + +@@ -1624,6 +1627,7 @@ int cil_resolve_sensitivityorder(struct cil_tree_node *current, void *extra_args + return SEPOL_OK; + + exit: ++ free(new); + return rc; + } + +@@ -2853,6 +2857,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + rc = cil_fill_cats(pc, &catset->cats); + if (rc != SEPOL_OK) { + cil_destroy_catset(catset); ++ cil_destroy_args(new_arg); + goto exit; + } + cil_tree_node_init(&cat_node); +@@ -2877,6 +2882,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous level, rc: %d\n", rc); + cil_destroy_level(level); ++ cil_destroy_args(new_arg); + goto exit; + } + cil_tree_node_init(&lvl_node); +@@ -2901,6 +2907,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous levelrange, rc: %d\n", rc); + cil_destroy_levelrange(range); ++ cil_destroy_args(new_arg); + goto exit; + } + cil_tree_node_init(&range_node); +@@ -2925,6 +2932,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous ip address, rc; %d\n", rc); + cil_destroy_ipaddr(ipaddr); ++ cil_destroy_args(new_arg); + goto exit; + } + cil_tree_node_init(&addr_node); +@@ -2955,6 +2963,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + if (rc != SEPOL_OK) { + cil_log(CIL_ERR, "Failed to create anonymous classpermission\n"); + cil_destroy_classpermission(cp); ++ cil_destroy_args(new_arg); + goto exit; + } + cil_tree_node_init(&cp_node); +@@ -2970,6 +2979,7 @@ int cil_resolve_call1(struct cil_tree_node *current, void *extra_args) + default: + cil_log(CIL_ERR, "Unexpected flavor: %d\n", + (((struct cil_param*)item->data)->flavor)); ++ cil_destroy_args(new_arg); + rc = SEPOL_ERR; + goto exit; + } +diff --git libsepol-2.8/cil/src/cil_symtab.c libsepol-2.8/cil/src/cil_symtab.c +index 3769979..2970b86 100644 +--- libsepol-2.8/cil/src/cil_symtab.c ++++ libsepol-2.8/cil/src/cil_symtab.c +@@ -185,6 +185,7 @@ int cil_complex_symtab_insert(struct cil_complex_symtab *symtab, + ckey->key2 == curr->ckey->key2 && + ckey->key3 == curr->ckey->key3 && + ckey->key4 == curr->ckey->key4) { ++ free(node); + return SEPOL_EEXIST; + } + +diff --git libsepol-2.8/include/sepol/errcodes.h libsepol-2.8/include/sepol/errcodes.h +index 0136564..6e9ff31 100644 +--- libsepol-2.8/include/sepol/errcodes.h ++++ libsepol-2.8/include/sepol/errcodes.h +@@ -12,7 +12,7 @@ extern "C" { + #define SEPOL_OK 0 + + /* These first error codes are defined for compatibility with +- * previous version of libsepol. In the future, custome error ++ * previous version of libsepol. In the future, custom error + * codes that don't map to system error codes should be defined + * outside of the range of system error codes. + */ +diff --git libsepol-2.8/src/expand.c libsepol-2.8/src/expand.c +index 6f1b235..125a680 100644 +--- libsepol-2.8/src/expand.c ++++ libsepol-2.8/src/expand.c +@@ -1451,6 +1451,7 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r + new_trans->name = strdup(cur_rule->name); + if (!new_trans->name) { + ERR(state->handle, "Out of memory!"); ++ free(new_trans); + return -1; + } + new_trans->stype = i + 1; +@@ -1460,6 +1461,8 @@ static int expand_filename_trans(expand_state_t *state, filename_trans_rule_t *r + otype = calloc(1, sizeof(*otype)); + if (!otype) { + ERR(state->handle, "Out of memory!"); ++ free(new_trans->name); ++ free(new_trans); + return -1; + } + otype->otype = mapped_otype; +diff --git libsepol-2.8/src/kernel_to_cil.c libsepol-2.8/src/kernel_to_cil.c +index b1eb66d..8d58e04 100644 +--- libsepol-2.8/src/kernel_to_cil.c ++++ libsepol-2.8/src/kernel_to_cil.c +@@ -2019,6 +2019,8 @@ static int write_cond_av_list_to_cil(FILE *out, struct policydb *pdb, cond_av_li + return 0; + + exit: ++ strs_free_all(strs); ++ strs_destroy(&strs); + return rc; + } + +diff --git libsepol-2.8/src/kernel_to_common.c libsepol-2.8/src/kernel_to_common.c +index 342bc3c..19a8c0e 100644 +--- libsepol-2.8/src/kernel_to_common.c ++++ libsepol-2.8/src/kernel_to_common.c +@@ -80,10 +80,12 @@ static char *create_str_helper(const char *fmt, int num, va_list vargs) + goto exit; + } + ++ va_end(vargs2); + return str; + + exit: + free(str); ++ va_end(vargs2); + return NULL; + } + +diff --git libsepol-2.8/src/kernel_to_conf.c libsepol-2.8/src/kernel_to_conf.c +index 9540520..a74e6c4 100644 +--- libsepol-2.8/src/kernel_to_conf.c ++++ libsepol-2.8/src/kernel_to_conf.c +@@ -1987,6 +1987,8 @@ static int write_cond_av_list_to_conf(FILE *out, struct policydb *pdb, cond_av_l + return 0; + + exit: ++ strs_free_all(strs); ++ strs_destroy(&strs); + return rc; + } + diff --git a/libsepol.spec b/libsepol.spec index 2fc62ef..08c8e2a 100644 --- a/libsepol.spec +++ b/libsepol.spec @@ -1,13 +1,13 @@ Summary: SELinux binary policy manipulation library Name: libsepol Version: 2.8 -Release: 2%{?dist} +Release: 3%{?dist} License: LGPLv2+ Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20180524/libsepol-2.8.tar.gz # download https://raw.githubusercontent.com/fedora-selinux/scripts/master/selinux/make-fedora-selinux-patch.sh # run: # $ VERSION=2.8 ./make-fedora-selinux-patch.sh libsepol -# HEAD https://github.com/fedora-selinux/selinux/commit/11eab8523bec5fcded6c336e3112f30f7931cba6 +# HEAD https://github.com/fedora-selinux/selinux/commit/decd49caec76a87817686f84716503151cf2be5d # Patch1: libsepol-fedora.patch URL: https://github.com/SELinuxProject/selinux/wiki BuildRequires: gcc @@ -94,6 +94,9 @@ exit 0 %{_libdir}/libsepol.so.1 %changelog +* Tue Nov 13 2018 Petr Lautrbach - 2.8-3 +- Fix RESOURCE_LEAK coverity scan defects + * Fri Jul 13 2018 Fedora Release Engineering - 2.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild