On Wed, 2007-05-23 at 09:12 -0400, Christopher J. PeBenito wrote:
>
> +static int get_permissions_callback(void *k, void *d, void *args)
> +{
> + struct perm_datum *datum = d;
> + char *name = k, **perms = args;
> + int value = datum->value - 1;
> +
> + perms[value] = kstrdup(name, GFP_ATOMIC);
> + if (!perms[value])
> + return -ENOMEM;
> +
> + return 0;
> +}
> +
> +int security_get_permissions(char *class, char ***perms, int *nperms)
> +{

[...]
> + *nperms = match->permissions.nprim;
> + *perms = kcalloc(*nperms, sizeof(*perms), GFP_ATOMIC);
> + if (!*perms)
> + goto out;
> +
> + if (match->comdatum) {
> + rc = hashtab_map(match->comdatum->permissions.table,
> + get_permissions_callback, *perms);
> + if (rc < 0)
> + goto err;
> + }
> +
> + rc = hashtab_map(match->permissions.table, get_permissions_callback,
> + *perms);

 So I'm probably just wasting your time out of ignorance here, but this looks really suspicious to me. Why don't you need to add in match->comdatum->permissions.nprim for the allocation? Also how is it guaranteed that one "datum->value - 1" won't be the same in both hashtabs? (if it isn't you've leaked memory).

-- 
James Antill <jantill@redhat.com>




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



application/pgp-signature attachment: This is a digitally signed message part