The following patch fixes the problem.
scontext is allocated by matchpathcon(3) and needs to be freed by the caller.
If it's not set to NULL before the attempted allocation then it'll keep the
previous value (which had been freed) and then you get a double-free.
--- dpkg-1.14.16.6.orig/src/archives.c
+++ dpkg-1.14.16.6/src/archives.c
@@ -629,6 +629,7 @@
* or if it has no context; in which case the default
* context shall be applied.
*/
+ scontext = NULL;
if( ! ((matchpathcon(fnamevb.buf,
(nifd->namenode->statoverride ?
nifd->namenode->statoverride->mode : ti->Mode)
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
