[PATCH 2/5] checkpolicy: clone level only once

[Christian Göttsche <cgzones@xxxxxxxxxxxxxx>]

In case of aliases clone the level only once to avoid leaking the fist
one.

Example policy:

    class p sid h class p{d}sensitivity d alias s0;dominance{s0}level d;level s0;

Reported-by: oss-fuzz (issue #67308)
Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>
---
 checkpolicy/policy_define.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 614b7706..0cf938ea 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -1038,7 +1038,7 @@ static int clone_level(hashtab_key_t key __attribute__ ((unused)), hashtab_datum
 	level_datum_t *levdatum = (level_datum_t *) datum;
 	mls_level_t *level = (mls_level_t *) arg, *newlevel;
 
-	if (levdatum->level == level) {
+	if (levdatum->notdefined && levdatum->level == level) {
 		if (!levdatum->isalias) {
 			levdatum->notdefined = FALSE;
 			return 0;
-- 
2.43.0