diff options
| author | Michal Sekletar <msekleta@redhat.com> | 2014-10-13 15:25:09 +0200 |
|---|---|---|
| committer | Michal Sekletar <msekleta@redhat.com> | 2014-10-15 10:58:27 +0200 |
| commit | 5e78424f4a27c07be50e246308035c877f204038 (patch) | |
| tree | 3b0919de1031075f4aa6dcf08e3cd05fa80415e9 /src | |
| parent | 3e883473a0f36c220fc45ecf61d6878c9ac308b4 (diff) | |
selinux: fix potential double free crash in child process
Before returning from function we should reset ret to NULL, thus cleanup
function is nop.
Also context_str() returns pointer to a string containing context but not a
copy, hence we must make copy it explicitly.
Diffstat (limited to 'src')
| -rw-r--r-- | src/shared/label.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/shared/label.c b/src/shared/label.c index b6af38d82d..69d4616183 100644 --- a/src/shared/label.c +++ b/src/shared/label.c @@ -334,7 +334,7 @@ int label_get_child_mls_label(int socket_fd, const char *exe, char **label) { } freecon(mycon); - mycon = context_str(bcon); + mycon = strdup(context_str(bcon)); if (!mycon) { r = -errno; goto out; @@ -348,6 +348,7 @@ int label_get_child_mls_label(int socket_fd, const char *exe, char **label) { } *label = ret; + ret = NULL; r = 0; out: |