1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
From b14534df3a481ea73eee578b90dcf34c96e4a2c9 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Tue, 8 Nov 2016 10:46:14 -0500
Subject: [PATCH] libsepol: sepol_{bool|iface|user}_key_create: copy name
The sepol_{bool|iface|user}_key_create() functions were not
copying the name. This produces a use-after-free in the
swig-generated code for python3 bindings. Copy the name
in these functions, and free it upon sepol_{bool|iface|user}_key_free().
Reported-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
libsepol/src/boolean_record.c | 10 ++++++++--
libsepol/src/iface_record.c | 10 ++++++++--
libsepol/src/user_record.c | 10 ++++++++--
3 files changed, 24 insertions(+), 6 deletions(-)
diff --git a/libsepol/src/boolean_record.c b/libsepol/src/boolean_record.c
index 8b644138a3bc..ebef7f18f0f9 100644
--- a/libsepol/src/boolean_record.c
+++ b/libsepol/src/boolean_record.c
@@ -15,7 +15,7 @@ struct sepol_bool {
struct sepol_bool_key {
/* This boolean's name */
- const char *name;
+ char *name;
};
int sepol_bool_key_create(sepol_handle_t * handle,
@@ -30,7 +30,12 @@ int sepol_bool_key_create(sepol_handle_t * handle,
return STATUS_ERR;
}
- tmp_key->name = name;
+ tmp_key->name = strdup(name);
+ if (!tmp_key->name) {
+ ERR(handle, "out of memory, " "could not create boolean key");
+ free(tmp_key);
+ return STATUS_ERR;
+ }
*key_ptr = tmp_key;
return STATUS_SUCCESS;
@@ -62,6 +67,7 @@ int sepol_bool_key_extract(sepol_handle_t * handle,
void sepol_bool_key_free(sepol_bool_key_t * key)
{
+ free(key->name);
free(key);
}
diff --git a/libsepol/src/iface_record.c b/libsepol/src/iface_record.c
index 09adeb79f5e9..c8b977c8facc 100644
--- a/libsepol/src/iface_record.c
+++ b/libsepol/src/iface_record.c
@@ -20,7 +20,7 @@ struct sepol_iface {
struct sepol_iface_key {
/* Interface name */
- const char *name;
+ char *name;
};
/* Key */
@@ -36,7 +36,12 @@ int sepol_iface_key_create(sepol_handle_t * handle,
return STATUS_ERR;
}
- tmp_key->name = name;
+ tmp_key->name = strdup(name);
+ if (!tmp_key->name) {
+ ERR(handle, "out of memory, could not create interface key");
+ free(tmp_key);
+ return STATUS_ERR;
+ }
*key_ptr = tmp_key;
return STATUS_SUCCESS;
@@ -68,6 +73,7 @@ int sepol_iface_key_extract(sepol_handle_t * handle,
void sepol_iface_key_free(sepol_iface_key_t * key)
{
+ free(key->name);
free(key);
}
diff --git a/libsepol/src/user_record.c b/libsepol/src/user_record.c
index c59c54b1e9b5..e7e2fc20fe36 100644
--- a/libsepol/src/user_record.c
+++ b/libsepol/src/user_record.c
@@ -24,7 +24,7 @@ struct sepol_user {
struct sepol_user_key {
/* This user's name */
- const char *name;
+ char *name;
};
int sepol_user_key_create(sepol_handle_t * handle,
@@ -40,7 +40,12 @@ int sepol_user_key_create(sepol_handle_t * handle,
return STATUS_ERR;
}
- tmp_key->name = name;
+ tmp_key->name = strdup(name);
+ if (!tmp_key->name) {
+ ERR(handle, "out of memory, could not create selinux user key");
+ free(tmp_key);
+ return STATUS_ERR;
+ }
*key_ptr = tmp_key;
return STATUS_SUCCESS;
@@ -71,6 +76,7 @@ int sepol_user_key_extract(sepol_handle_t * handle,
void sepol_user_key_free(sepol_user_key_t * key)
{
+ free(key->name);
free(key);
}
--
2.10.2
|
