Free allocated memory when clean up / exit.android-sdk-4.4.2_r1.0.1android-sdk-4.4.2_r1android-cts-4.4_r4android-cts-4.4_r1android-4.4_r1.2.0.1android-4.4_r1.2android-4.4_r1.1.0.1android-4.4_r1.1android-4.4_r1.0.1android-4.4_r1android-4.4_r0.9android-4.4_r0.8android-4.4_r0.7android-4.4.4_r2.0.1android-4.4.4_r2android-4.4.4_r1.0.1android-4.4.4_r1android-4.4.3_r1.1.0.1android-4.4.3_r1.1android-4.4.3_r1.0.1android-4.4.3_r1android-4.4.2_r2.0.1android-4.4.2_r2android-4.4.2_r1.0.1android-4.4.2_r1android-4.4.1_r1.0.1android-4.4.1_r1android-4.3_r3.1android-4.3_r3android-4.3_r2.3android-4.3_r2.2android-4.3_r2.1android-4.3_r2android-4.3_r1.1android-4.3_r1android-4.3_r0.9.1android-4.3_r0.9android-4.3.1_r1tools_r22.2tools_r22kitkat-releasekitkat-mr2.2-releasekitkat-mr2.1-releasekitkat-mr2-releasekitkat-mr1.1-releasekitkat-mr1-releasekitkat-devkitkat-cts-releasekitkat-cts-devjb-mr2.0.0-releasejb-mr2.0-releasejb-mr2-releasejb-mr2-devjb-mr1.1-dev-plus-aosp

Change-Id: I116a3e1fa17f357b10e7414efde6c78ffb9678df

1 files changed, 20 insertions, 5 deletions

diff --git a/policy_define.c b/policy_define.c
index 2c12447..8af6141 100644
--- a/policy_define.c
+++ b/policy_define.c
@@ -1497,12 +1497,12 @@ int define_compute_type_helper(int which, avrule_t ** rule)
 
 	while ((id = queue_remove(id_queue))) {
 		if (set_types(&avrule->stypes, id, &add, 0))
-			return -1;
+			goto bad;
 	}
 	add = 1;
 	while ((id = queue_remove(id_queue))) {
 		if (set_types(&avrule->ttypes, id, &add, 0))
-			return -1;
+			goto bad;
 	}
 
 	ebitmap_init(&tclasses);
@@ -1531,7 +1531,7 @@ int define_compute_type_helper(int which, avrule_t ** rule)
 			perm = malloc(sizeof(class_perm_node_t));
 			if (!perm) {
 				yyerror("out of memory");
-				return -1;
+				goto bad;
 			}
 			class_perm_node_init(perm);
 			perm->class = i + 1;
@@ -2050,10 +2050,12 @@ role_datum_t *merge_roles_dom(role_datum_t * r1, role_datum_t * r2)
 	new->s.value = 0;		/* temporary role */
 	if (ebitmap_or(&new->dominates, &r1->dominates, &r2->dominates)) {
 		yyerror("out of memory");
+		free(new);
 		return NULL;
 	}
 	if (ebitmap_or(&new->types.types, &r1->types.types, &r2->types.types)) {
 		yyerror("out of memory");
+		free(new);
 		return NULL;
 	}
 	if (!r1->s.value) {
@@ -2458,13 +2460,17 @@ int define_role_allow(void)
 	role_allow_rule_init(ra);
 
 	while ((id = queue_remove(id_queue))) {
-		if (set_roles(&ra->roles, id))
+		if (set_roles(&ra->roles, id)) {
+			free(ra);
 			return -1;
+		}
 	}
 
 	while ((id = queue_remove(id_queue))) {
-		if (set_roles(&ra->new_roles, id))
+		if (set_roles(&ra->new_roles, id)) {
+			free(ra);
 			return -1;
+		}
 	}
 
 	append_role_allow(ra);
@@ -2777,6 +2783,7 @@ int define_constraint(constraint_expr_t * expr)
 		}
 		if (!node->expr) {
 			yyerror("out of memory");
+			free(node);
 			return -1;
 		}
 		node->permissions = 0;
@@ -3281,6 +3288,7 @@ cond_expr_t *define_cond_expr(uint32_t expr_type, void *arg1, void *arg2)
 		return expr;
 	default:
 		yyerror("illegal conditional expression");
+		free(expr);
 		return NULL;
 	}
 }
@@ -3582,6 +3590,12 @@ static int parse_security_context(context_struct_t * c)
 		return 0;
 	}
 
+	/* check context c to make sure ok to dereference c later */
+	if (c == NULL) {
+		yyerror("null context pointer!");
+		return -1;
+	}
+
 	context_init(c);
 
 	/* extract the user */
@@ -4673,6 +4687,7 @@ int define_range_trans(int class_specified)
 
 out:
 	range_trans_rule_destroy(rule);
+	free(rule);
 	return -1;
 }