user = kmalloc(size+1, GFP_KERNEL); 
user = kzalloc(size+1, GFP_KERNEL); 
static ssize_t sel_write_user(struct file * file, char *buf, size_t size){	char *con, *user, *ptr;	u32 sid, *sids;	ssize_t length;	char *newcon;	int i, rc;	u32 len, nsids;	length = task_has_security(current, SECURITY__COMPUTE_USER);	if (length)		return length;	length = -ENOMEM;	con = kmalloc(size+1, GFP_KERNEL);	if (!con)		return length;	memset(con, 0, size+1);	user = kmalloc(size+1, GFP_KERNEL);	if (!user)		goto out;	memset(user, 0, size+1);	length = -EINVAL;	if (sscanf(buf, "%s %s", con, user) != 2)		goto out2;	length = security_context_to_sid(con, strlen(con)+1, &sid);	if (length < 0)		goto out2;	length = security_get_user_sids(sid, user, &sids, &nsids);	if (length < 0)		goto out2;	length = sprintf(buf, "%u", nsids) + 1;	ptr = buf + length;	for (i = 0; i < nsids; i++) {		rc = security_sid_to_context(sids[i], &newcon, &len);		if (rc) {			length = rc;			goto out3;		}		if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {			kfree(newcon);			length = -ERANGE;			goto out3;		}		memcpy(ptr, newcon, len);		kfree(newcon);		ptr += len;		length += len;	}out3:	kfree(sids);out2:	kfree(user);out:	kfree(con);	return length;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/89d155ef62e5e0c10e4b37aaa5056f0beafe10e6/selinuxfs.c/buggy/security/selinux/selinuxfs.c