• Ondrej Mosnacek's avatar
    selinux: fix NULL-pointer dereference when hashtab allocation fails · dc27f3c5
    Ondrej Mosnacek authored
    When the hash table slot array allocation fails in hashtab_init(),
    h->size is left initialized with a non-zero value, but the h->htable
    pointer is NULL. This may then cause a NULL pointer dereference, since
    the policydb code relies on the assumption that even after a failed
    hashtab_init(), hashtab_map() and hashtab_destroy() can be safely called
    on it. Yet, these detect an empty hashtab only by looking at the size.
    
    Fix this by making sure that hashtab_init() always leaves behind a valid
    empty hashtab when the allocation fails.
    
    Cc: stable@vger.kernel.org
    Fixes: 03414a49 ("selinux: do not allocate hashtabs dynamically")
    Signed-off-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    dc27f3c5
hashtab.c 4.09 KB