github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

apparmor: fix a leak on a rejected string table entry

Browse Source 
unpack_strs_table() stores each entry into the table only after
validating it, so an entry the validation rejects is never freed. Up
to 64KB leaks per rejected entry.

Store the pointer before validating it.

Fixes: c140dcd124 ("apparmor: make str table more generic and be able to have multiple entries")
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
This commit is contained in:
Maxime Bélair 2026-08-19 14:19:44 +01:00 committed by John Johansen
parent 1f5428b9f9
commit f7bd6285ff
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
security/apparmor/policy_unpack.c
View File

@ -558,6 +558,9 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi,
/* aa_unpack_strdup verifies that the last character is
* null termination byte.
*/
/* publish before validating; the error path frees it */
table[i].strs = str;
table[i].size = size2;
c = process_strs_entry(str, size2, multi);
if (c <= 0) {
AA_DEBUG(DEBUG_UNPACK, "process_strs %d i %d pos %ld",
@ -570,9 +573,7 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi,
/* fail - all other cases with embedded \0 */
goto fail;
}
table[i].strs = str;
table[i].count = c;
table[i].size = size2;
}
if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL))
goto fail;