libsepol-3.7-3.fc42

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1]
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c: scope_hint: In function ‘cil_yy_create_buffer’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1578:12: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc(64)’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.l:89:21: note: in expansion of macro ‘yylex’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:913:21: note: in expansion of macro ‘yylex’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:936:1: note: in expansion of macro ‘YY_DECL’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:960:18: note: in expansion of macro ‘yyensure_buffer_stack’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:960:18: note: in expansion of macro ‘yyensure_buffer_stack’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1717:13: note: in expansion of macro ‘yyensure_buffer_stack’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:960:18: note: in expansion of macro ‘yyensure_buffer_stack’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:962:26: note: in expansion of macro ‘yy_create_buffer’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1564:21: note: in expansion of macro ‘yy_create_buffer’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1568:24: note: in expansion of macro ‘yyalloc’
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c: scope_hint: In function ‘cil_yy_create_buffer’
# 1576|   	 * we need to put in 2 end-of-buffer characters.
# 1577|   	 */
# 1578|-> 	b->yy_ch_buf = (char *) yyalloc( (yy_size_t) (b->yy_buf_size + 2)  );
# 1579|   	if ( ! b->yy_ch_buf )
# 1580|   		YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" );

Error: CPPCHECK_WARNING (CWE-476): [#def2]
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1618: warning[nullPointer]: Possible null pointer dereference: b
# 1616|       
# 1617|   	yy_flush_buffer( b );
# 1618|-> 
# 1619|   	b->yy_input_file = file;
# 1620|   	b->yy_fill_buffer = 1;

Error: CPPCHECK_WARNING (CWE-476): [#def3]
libsepol-3.7-build/libsepol-3.7/cil/src/cil_lexer.c:1619: warning[nullPointer]: Possible null pointer dereference: b
# 1617|   	yy_flush_buffer( b );
# 1618|   
# 1619|-> 	b->yy_input_file = file;
# 1620|   	b->yy_fill_buffer = 1;
# 1621|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
libsepol-3.7-build/libsepol-3.7/src/ebitmap.c: scope_hint: In function ‘ebitmap_read’
libsepol-3.7-build/libsepol-3.7/src/ebitmap.c:616:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘l’
#  614|   		l = n;
#  615|   	}
#  616|-> 	if (count && l->startbit + MAPSIZE != e->highbit) {
#  617|   		ERR(NULL, "security: ebitmap: high bit %u has not the expected value %zu",
#  618|   		     e->highbit, l->startbit + MAPSIZE);

Error: GCC_ANALYZER_WARNING (CWE-122): [#def5]
libsepol-3.7-build/libsepol-3.7/src/module.c: scope_hint: In function ‘module_package_read_offsets’
libsepol-3.7-build/libsepol-3.7/src/module.c:444:36: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
libsepol-3.7-build/libsepol-3.7/src/module.c:28: included_from: Included from here.
libsepol-3.7-build/libsepol-3.7/src/private.h:27:25: note: in definition of macro ‘le32_to_cpu’
#  442|   		goto err;
#  443|   
#  444|-> 	if (nsec && off[nsec] < off[nsec-1]) {
#  445|   		ERR(file->handle, "offset greater than file size (at %u, "
#  446|   		    "offset %zu -> %zu", nsec, off[nsec - 1],

Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c: scope_hint: In function ‘typealias_list_destroy’
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c:359:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘typealias_lists’
#  357|   	uint32_t i;
#  358|   	for (i = 0; i < typealias_lists_len; i++) {
#  359|-> 		if (typealias_lists[i] != NULL) {
#  360|   			list_destroy(&typealias_lists[i]);
#  361|   		}

Error: GCC_ANALYZER_WARNING (CWE-415): [#def7]
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c: scope_hint: In function ‘constraint_expr_to_string’
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c:1946:9: warning[-Wanalyzer-double-free]: double-‘free’ of ‘val2’
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c:55: included_from: Included from here.
libsepol-3.7-build/libsepol-3.7/src/debug.h:50:9: note: in expansion of macro ‘msg_write’
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c:1865:33: note: in expansion of macro ‘ERR’
# 1944|   	free(new_val);
# 1945|   	free(val1);
# 1946|-> 	free(val2);
# 1947|   	if (stack != NULL) {
# 1948|   		while ((val1 = stack_pop(stack)) != NULL) {

Error: CPPCHECK_WARNING (CWE-457): [#def8]
libsepol-3.7-build/libsepol-3.7/src/module_to_cil.c:2954: error[uninitvar]: Uninitialized variable: ocon
# 2952|   	int ocon;
# 2953|   
# 2954|-> 	static int (*const *ocon_funcs)(struct policydb *pdb, struct ocontext *ocon);
# 2955|   	static int (*const ocon_selinux_funcs[OCON_NUM])(struct policydb *pdb, struct ocontext *ocon) = {
# 2956|   		ocontext_selinux_isid_to_cil,

Error: CPPCHECK_WARNING (CWE-476): [#def9]
libsepol-3.7-build/libsepol-3.7/src/services.c:803: warning[nullPointer]: Possible null pointer dereference: p
#  801|   			while (1) {
#  802|   				p = *r_buf ? (*r_buf + reason_buf_used) : NULL;
#  803|-> 				len = snprintf(p, reason_buf_len - reason_buf_used,
#  804|   						"%s", buffers[x]);
#  805|   				if (len < 0 || len >= reason_buf_len - reason_buf_used) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def10]
libsepol-3.7-build/libsepol-3.7/src/util.c: scope_hint: In function ‘tokenize’
libsepol-3.7-build/libsepol-3.7/src/util.c:297:21: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
#  295|   
#  296|   	for (items = 0; items < num_args && *buf_p != '\0'; items++) {
#  297|-> 		arg = va_arg(ap, char **);
#  298|   
#  299|   		/* Save the remainder of the string in arg */

Error: CPPCHECK_WARNING (CWE-457): [#def11]
libsepol-3.7-build/libsepol-3.7/src/write.c:1828: warning[uninitvar]: Uninitialized variable: buf32
# 1826|   		for (i = 0; i < nel; i++)
# 1827|   			buf32[i] = cpu_to_le32(avrule->xperms->perms[i]);
# 1828|-> 		items = put_entry(buf32, sizeof(uint32_t), nel, fp);
# 1829|   		if (items != nel)
# 1830|   			return POLICYDB_ERROR;

Scan Properties