On 03/05/2018 05:58 PM, Nicolas Iooss wrote:
> In sepol_ibendport_key_create(), if sepol_ibendport_alloc_ibdev_name()
> fails to allocate tmp_key->ibdev_name, sepol_ibendport_key_free() is
> called to free the memory associated with tmp_key, which results in
> free() being called on uninitialized tmp_key->ibdev_name.
>
> This issue is reported by clang's static analyzer with the following
> message:
>
> ibendport_record.c:115:2: warning: 1st function call argument is an
> uninitialized value
> free(key->ibdev_name);
> ^~~~~~~~~~~~~~~~~~~~~
>
> Signed-off-by: Nicolas Iooss <nicolas.iooss@xxxxxxx>
Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
> ---
> libsepol/src/ibendport_record.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libsepol/src/ibendport_record.c b/libsepol/src/ibendport_record.c
> index 912aeb536fd9..8285a9d6ffcf 100644
> --- a/libsepol/src/ibendport_record.c
> +++ b/libsepol/src/ibendport_record.c
> @@ -62,8 +62,10 @@ int sepol_ibendport_key_create(sepol_handle_t *handle,
> goto omem;
> }
>
> - if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0)
> + if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) {
> + tmp_key->ibdev_name = NULL;
> goto err;
> + }
>
> strncpy(tmp_key->ibdev_name, ibdev_name, IB_DEVICE_NAME_MAX);
> tmp_key->port = port;
>
