diff options
| author | Maxime Bélair <maxime.belair@canonical.com> | 2026-08-19 14:19:44 +0100 |
|---|---|---|
| committer | John Johansen <john.johansen@canonical.com> | 2026-10-29 08:28:03 -0700 |
| commit | f7bd6285ffeb425793334f6d48ccb5035cab2fa7 (patch) | |
| tree | 80d2c0aecb9967aff2a9b845006a3ce20854033e /security | |
| parent | 1f5428b9f9bfb9dab6828015a5254dcd7c582a01 (diff) | |
apparmor: fix a leak on a rejected string table entry
unpack_strs_table() stores each entry into the table only after
validating it, so an entry the validation rejects is never freed. Up
to 64KB leaks per rejected entry.
Store the pointer before validating it.
Fixes: c140dcd1246b ("apparmor: make str table more generic and be able to have multiple entries")
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Diffstat (limited to 'security')
| -rw-r--r-- | security/apparmor/policy_unpack.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index f1fc48e72d0e..99bc4f946d15 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -558,6 +558,9 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi, /* aa_unpack_strdup verifies that the last character is * null termination byte. */ + /* publish before validating; the error path frees it */ + table[i].strs = str; + table[i].size = size2; c = process_strs_entry(str, size2, multi); if (c <= 0) { AA_DEBUG(DEBUG_UNPACK, "process_strs %d i %d pos %ld", @@ -570,9 +573,7 @@ static int unpack_strs_table(struct aa_ext *e, const char *name, bool multi, /* fail - all other cases with embedded \0 */ goto fail; } - table[i].strs = str; table[i].count = c; - table[i].size = size2; } if (!aa_unpack_nameX(e, AA_ARRAYEND, NULL)) goto fail; |