From 3ceabe1bfcb5c5fc5802d6c2b04918e3586dd989 Mon Sep 17 00:00:00 2001 From: Jim Meyering Date: Tue, 20 May 2008 17:58:42 +0200 Subject: [PATCH] install: avoid a leak in currently-ifdef'd-out code * src/install.c (setdefaultfilecon) [ENABLE_WHEN_MATCHPATHCON_IS_MORE_EFFICIENT]: Call matchpathcon_init_prefix only once. Suggestion from Stephen Smalley. Reported by Ben Webb in . --- src/install.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/install.c b/src/install.c index 1d04373..13feb85 100644 --- a/src/install.c +++ b/src/install.c @@ -208,6 +208,8 @@ setdefaultfilecon (char const *file) { struct stat st; security_context_t scontext = NULL; + static bool first_call = true; + if (selinux_enabled != 1) { /* Indicate no context found. */ @@ -216,11 +218,15 @@ setdefaultfilecon (char const *file) if (lstat (file, &st) != 0) return; - if (IS_ABSOLUTE_FILE_NAME (file)) + if (first_call && IS_ABSOLUTE_FILE_NAME (file)) { /* Calling matchpathcon_init_prefix (NULL, "/first_component/") is an optimization to minimize the expense of the following - matchpathcon call. */ + matchpathcon call. Do it only once, just before the first + matchpathcon call. We *could* call matchpathcon_fini after + the final matchpathcon call, but that's not necessary, since + by then we're about to exit, and besides, the buffers it + would free are still reachable. */ char const *p0; char const *p = file + 1; while (ISSLASH (*p)) @@ -247,6 +253,7 @@ setdefaultfilecon (char const *file) } } } + first_call = false; /* If there's an error determining the context, or it has none, return to allow default context */ -- 2.7.4