Xiaochen Wang
wangx****@gmail*****
Wed Mar 30 23:58:27 JST 2011
TOMOYO
ForkDescription: check tomoyo_get_name() return value in
tomoyo_write_profile
Although tomoyo_read_profile will check this value (see below),
we should not ignore the error of memory lacking.
tomoyo_read_profile():
const struct tomoyo_path_info *comment =
profile->comment;
tomoyo_io_printf(head, "%u-COMMENT=", index);
tomoyo_set_string(head, comment ? comment->name : "");
Signed-off-by: Xiaochen Wang <wangx****@gmail*****>
---
security/tomoyo/common.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 7556315..fed4a0c 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -461,6 +461,10 @@ static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
if (!strcmp(data, "COMMENT")) {
const struct tomoyo_path_info *old_comment = profile->comment;
profile->comment = tomoyo_get_name(cp);
+ if (!profile->comment) {
+ profile->comment = old_comment;
+ return -ENOMEM;
+ }
tomoyo_put_name(old_comment);
return 0;
}
--
1.7.2.3