Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
libsepol: zero member before potential dereference
The `next` member might be checked against NULL and dereferenced before it gets assigned, due to jumps from failure gotos to the cleanup section. ==31017==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x000000579654 bp 0x7ffd3a07d110 sp 0x7ffd3a07d000 T0) ==31017==The signal is caused by a READ memory access. ==31017==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used. #0 0x579654 in filename_trans_read_one ./libsepol/src/policydb.c:2874:55 #1 0x579654 in filename_trans_read ./libsepol/src/policydb.c:2902:9 SELinuxProject#2 0x5771b7 in policydb_read ./libsepol/src/policydb.c:4509:7 SELinuxProject#3 0x55a1f5 in LLVMFuzzerTestOneInput ./libsepol/fuzz/binpolicy-fuzzer.c:24:6 SELinuxProject#4 0x45aed3 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) fuzzer.o SELinuxProject#5 0x446a12 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) fuzzer.o SELinuxProject#6 0x44c93b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) fuzzer.o SELinuxProject#7 0x475dd2 in main (./out/binpolicy-fuzzer+0x475dd2) SELinuxProject#8 0x7f2a4e7f97ec in __libc_start_main csu/../csu/libc-start.c:332:16 SELinuxProject#9 0x423689 in _start (./out/binpolicy-fuzzer+0x423689) Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
- Loading branch information