From 1a088724c4d70edfbecab4252c1644100374f0f0 Mon Sep 17 00:00:00 2001

From: Jakub Hrozek <jhrozek@redhat.com>

Date: Wed, 2 Apr 2014 22:11:59 +0200

Subject: [PATCH 121/121] IPA: Fix SELinux mapping order memory hierarchy

https://fedorahosted.org/sssd/ticket/2300

The list of SELinux mapping orders was allocated on tmp_ctx and parsed

into an array. The array itself was correctly allocated on mem_ctx but

its contents remained on tmp_ctx, leading to a use-after-free error.

This patch fixes the memory hierarchy so that both the array and its

contents are allocated on mem_ctx.

(cherry picked from commit 355b8a655cfcc4e783077d12f76b55da1d23fb87)

Reviewed-by: Sumit Bose <sbose@redhat.com>

---

 src/providers/ipa/ipa_selinux.c | 16 ++++++++--------

 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/providers/ipa/ipa_selinux.c b/src/providers/ipa/ipa_selinux.c

index 7f59161918a04ff8c994a0ce0fe55924ff09eda7..b7cbe445f1ecbfffaa84bb049aaf45ba4ecb1a35 100644

--- a/src/providers/ipa/ipa_selinux.c

+++ b/src/providers/ipa/ipa_selinux.c

@@ -557,21 +557,15 @@ static errno_t create_order_array(TALLOC_CTX *mem_ctx, const char *map_order,

         goto done;

     }

-    order = talloc_strdup(tmp_ctx, map_order);

-    if (order == NULL) {

-        ret = ENOMEM;

-        goto done;

-    }

-    len = strlen(order);

-

     /* The "order" string contains one or more SELinux user records

      * separated by $. Now we need to create an array of string from

      * this one string. First find out how many elements in the array

      * will be. This way only one alloc will be necessary for the array

      */

     order_count = 1;

+    len = strlen(map_order);

     for (i = 0; i < len; i++) {

-        if (order[i] == '$') order_count++;

+        if (map_order[i] == '$') order_count++;

     }

     order_array = talloc_array(tmp_ctx, char *, order_count);

@@ -580,6 +574,12 @@ static errno_t create_order_array(TALLOC_CTX *mem_ctx, const char *map_order,

         goto done;

     }

+    order = talloc_strdup(order_array, map_order);

+    if (order == NULL) {

+        ret = ENOMEM;

+        goto done;

+    }

+

     /* Now fill the array with pointers to the original string. Also

      * use binary zeros to make multiple string out of the one.

      */

-- 

1.9.0