In an error path of define_bool_tunable(), variable id is freed after being used by a successful call to declare_symbol(). This may cause trouble as this pointer may have been used as-is in the policy symtab hash table.
Moreover bool_value is never freed after being used. Fix this memory leak too. This leak has been detected with gcc Address Sanitizer. Signed-off-by: Nicolas Iooss <[email protected]> --- checkpolicy/policy_define.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c index 864788992e5c..2ad98c3c851e 100644 --- a/checkpolicy/policy_define.c +++ b/checkpolicy/policy_define.c @@ -1704,11 +1704,11 @@ int define_bool_tunable(int is_tunable) bool_value = (char *)queue_remove(id_queue); if (!bool_value) { yyerror("no default value for bool definition?"); - free(id); return -1; } datum->state = (int)(bool_value[0] == 'T') ? 1 : 0; + free(bool_value); return 0; cleanup: cond_destroy_bool(id, datum, NULL); -- 2.11.0 _______________________________________________ Selinux mailing list [email protected] To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to [email protected].
