for (i = 0; i < 2; i++) buf[i] = le32_to_cpu(buf[i]);  if (buf[0] != POLICYDB_MAGIC) { 
if (le32_to_cpu(buf[0]) != POLICYDB_MAGIC) { 
int policydb_read(struct policydb *p, void *fp){	struct role_allow *ra, *lra;	struct role_trans *tr, *ltr;	struct ocontext *l, *c, *newc;	struct genfs *genfs_p, *genfs, *newgenfs;	int i, j, rc;	u32 buf[8], len, len2, config, nprim, nel, nel2;	char *policydb_str;	struct policydb_compat_info *info;	struct range_trans *rt, *lrt;	config = 0;	rc = policydb_init(p);	if (rc)		goto out;	/* Read the magic number and string length. */	rc = next_entry(buf, fp, sizeof(u32)* 2);	if (rc < 0)		goto bad;	for (i = 0; i < 2; i++)		buf[i] = le32_to_cpu(buf[i]);	if (buf[0] != POLICYDB_MAGIC) {		printk(KERN_ERR "security:  policydb magic number 0x%x does "		       "not match expected magic number 0x%x\n",		       buf[0], POLICYDB_MAGIC);		goto bad;	}	len = buf[1];	if (len != strlen(POLICYDB_STRING)) {		printk(KERN_ERR "security:  policydb string length %d does not "		       "match expected length %Zu\n",		       len, strlen(POLICYDB_STRING));		goto bad;	}	policydb_str = kmalloc(len + 1,GFP_KERNEL);	if (!policydb_str) {		printk(KERN_ERR "security:  unable to allocate memory for policydb "		       "string of length %d\n", len);		rc = -ENOMEM;		goto bad;	}	rc = next_entry(policydb_str, fp, len);	if (rc < 0) {		printk(KERN_ERR "security:  truncated policydb string identifier\n");		kfree(policydb_str);		goto bad;	}	policydb_str[len] = 0;	if (strcmp(policydb_str, POLICYDB_STRING)) {		printk(KERN_ERR "security:  policydb string %s does not match "		       "my string %s\n", policydb_str, POLICYDB_STRING);		kfree(policydb_str);		goto bad;	}	/* Done with policydb_str. */	kfree(policydb_str);	policydb_str = NULL;	/* Read the version, config, and table sizes. */	rc = next_entry(buf, fp, sizeof(u32)*4);	if (rc < 0)		goto bad;	for (i = 0; i < 4; i++)		buf[i] = le32_to_cpu(buf[i]);	p->policyvers = buf[0];	if (p->policyvers < POLICYDB_VERSION_MIN ||	    p->policyvers > POLICYDB_VERSION_MAX) {	    	printk(KERN_ERR "security:  policydb version %d does not match "	    	       "my version range %d-%d\n",	    	       buf[0], POLICYDB_VERSION_MIN, POLICYDB_VERSION_MAX);	    	goto bad;	}	if ((buf[1] & POLICYDB_CONFIG_MLS)) {		if (ss_initialized && !selinux_mls_enabled) {			printk(KERN_ERR "Cannot switch between non-MLS and MLS "			       "policies\n");			goto bad;		}		selinux_mls_enabled = 1;		config |= POLICYDB_CONFIG_MLS;		if (p->policyvers < POLICYDB_VERSION_MLS) {			printk(KERN_ERR "security policydb version %d (MLS) "			       "not backwards compatible\n", p->policyvers);			goto bad;		}	} else {		if (ss_initialized && selinux_mls_enabled) {			printk(KERN_ERR "Cannot switch between MLS and non-MLS "			       "policies\n");			goto bad;		}	}	info = policydb_lookup_compat(p->policyvers);	if (!info) {		printk(KERN_ERR "security:  unable to find policy compat info "		       "for version %d\n", p->policyvers);		goto bad;	}	if (buf[2] != info->sym_num || buf[3] != info->ocon_num) {		printk(KERN_ERR "security:  policydb table sizes (%d,%d) do "		       "not match mine (%d,%d)\n", buf[2], buf[3],		       info->sym_num, info->ocon_num);		goto bad;	}	for (i = 0; i < info->sym_num; i++) {		rc = next_entry(buf, fp, sizeof(u32)*2);		if (rc < 0)			goto bad;		nprim = le32_to_cpu(buf[0]);		nel = le32_to_cpu(buf[1]);		for (j = 0; j < nel; j++) {			rc = read_f[i](p, p->symtab[i].table, fp);			if (rc)				goto bad;		}		p->symtab[i].nprim = nprim;	}	rc = avtab_read(&p->te_avtab, fp, p->policyvers);	if (rc)		goto bad;	if (p->policyvers >= POLICYDB_VERSION_BOOL) {		rc = cond_read_list(p, fp);		if (rc)			goto bad;	}	rc = next_entry(buf, fp, sizeof(u32));	if (rc < 0)		goto bad;	nel = le32_to_cpu(buf[0]);	ltr = NULL;	for (i = 0; i < nel; i++) {		tr = kmalloc(sizeof(*tr), GFP_KERNEL);		if (!tr) {			rc = -ENOMEM;			goto bad;		}		memset(tr, 0, sizeof(*tr));		if (ltr) {			ltr->next = tr;		} else {			p->role_tr = tr;		}		rc = next_entry(buf, fp, sizeof(u32)*3);		if (rc < 0)			goto bad;		tr->role = le32_to_cpu(buf[0]);		tr->type = le32_to_cpu(buf[1]);		tr->new_role = le32_to_cpu(buf[2]);		ltr = tr;	}	rc = next_entry(buf, fp, sizeof(u32));	if (rc < 0)		goto bad;	nel = le32_to_cpu(buf[0]);	lra = NULL;	for (i = 0; i < nel; i++) {		ra = kmalloc(sizeof(*ra), GFP_KERNEL);		if (!ra) {			rc = -ENOMEM;			goto bad;		}		memset(ra, 0, sizeof(*ra));		if (lra) {			lra->next = ra;		} else {			p->role_allow = ra;		}		rc = next_entry(buf, fp, sizeof(u32)*2);		if (rc < 0)			goto bad;		ra->role = le32_to_cpu(buf[0]);		ra->new_role = le32_to_cpu(buf[1]);		lra = ra;	}	rc = policydb_index_classes(p);	if (rc)		goto bad;	rc = policydb_index_others(p);	if (rc)		goto bad;	for (i = 0; i < info->ocon_num; i++) {		rc = next_entry(buf, fp, sizeof(u32));		if (rc < 0)			goto bad;		nel = le32_to_cpu(buf[0]);		l = NULL;		for (j = 0; j < nel; j++) {			c = kmalloc(sizeof(*c), GFP_KERNEL);			if (!c) {				rc = -ENOMEM;				goto bad;			}			memset(c, 0, sizeof(*c));			if (l) {				l->next = c;			} else {				p->ocontexts[i] = c;			}			l = c;			rc = -EINVAL;			switch (i) {			case OCON_ISID:				rc = next_entry(buf, fp, sizeof(u32));				if (rc < 0)					goto bad;				c->sid[0] = le32_to_cpu(buf[0]);				rc = context_read_and_validate(&c->context[0], p, fp);				if (rc)					goto bad;				break;			case OCON_FS:			case OCON_NETIF:				rc = next_entry(buf, fp, sizeof(u32));				if (rc < 0)					goto bad;				len = le32_to_cpu(buf[0]);				c->u.name = kmalloc(len + 1,GFP_KERNEL);				if (!c->u.name) {					rc = -ENOMEM;					goto bad;				}				rc = next_entry(c->u.name, fp, len);				if (rc < 0)					goto bad;				c->u.name[len] = 0;				rc = context_read_and_validate(&c->context[0], p, fp);				if (rc)					goto bad;				rc = context_read_and_validate(&c->context[1], p, fp);				if (rc)					goto bad;				break;			case OCON_PORT:				rc = next_entry(buf, fp, sizeof(u32)*3);				if (rc < 0)					goto bad;				c->u.port.protocol = le32_to_cpu(buf[0]);				c->u.port.low_port = le32_to_cpu(buf[1]);				c->u.port.high_port = le32_to_cpu(buf[2]);				rc = context_read_and_validate(&c->context[0], p, fp);				if (rc)					goto bad;				break;			case OCON_NODE:				rc = next_entry(buf, fp, sizeof(u32)* 2);				if (rc < 0)					goto bad;				c->u.node.addr = le32_to_cpu(buf[0]);				c->u.node.mask = le32_to_cpu(buf[1]);				rc = context_read_and_validate(&c->context[0], p, fp);				if (rc)					goto bad;				break;			case OCON_FSUSE:				rc = next_entry(buf, fp, sizeof(u32)*2);				if (rc < 0)					goto bad;				c->v.behavior = le32_to_cpu(buf[0]);				if (c->v.behavior > SECURITY_FS_USE_NONE)					goto bad;				len = le32_to_cpu(buf[1]);				c->u.name = kmalloc(len + 1,GFP_KERNEL);				if (!c->u.name) {					rc = -ENOMEM;					goto bad;				}				rc = next_entry(c->u.name, fp, len);				if (rc < 0)					goto bad;				c->u.name[len] = 0;				rc = context_read_and_validate(&c->context[0], p, fp);				if (rc)					goto bad;				break;			case OCON_NODE6: {				int k;				rc = next_entry(buf, fp, sizeof(u32) * 8);				if (rc < 0)					goto bad;				for (k = 0; k < 4; k++)					c->u.node6.addr[k] = le32_to_cpu(buf[k]);				for (k = 0; k < 4; k++)					c->u.node6.mask[k] = le32_to_cpu(buf[k+4]);				if (context_read_and_validate(&c->context[0], p, fp))					goto bad;				break;			}			}		}	}	rc = next_entry(buf, fp, sizeof(u32));	if (rc < 0)		goto bad;	nel = le32_to_cpu(buf[0]);	genfs_p = NULL;	rc = -EINVAL;	for (i = 0; i < nel; i++) {		rc = next_entry(buf, fp, sizeof(u32));		if (rc < 0)			goto bad;		len = le32_to_cpu(buf[0]);		newgenfs = kmalloc(sizeof(*newgenfs), GFP_KERNEL);		if (!newgenfs) {			rc = -ENOMEM;			goto bad;		}		memset(newgenfs, 0, sizeof(*newgenfs));		newgenfs->fstype = kmalloc(len + 1,GFP_KERNEL);		if (!newgenfs->fstype) {			rc = -ENOMEM;			kfree(newgenfs);			goto bad;		}		rc = next_entry(newgenfs->fstype, fp, len);		if (rc < 0) {			kfree(newgenfs->fstype);			kfree(newgenfs);			goto bad;		}		newgenfs->fstype[len] = 0;		for (genfs_p = NULL, genfs = p->genfs; genfs;		     genfs_p = genfs, genfs = genfs->next) {			if (strcmp(newgenfs->fstype, genfs->fstype) == 0) {				printk(KERN_ERR "security:  dup genfs "				       "fstype %s\n", newgenfs->fstype);				kfree(newgenfs->fstype);				kfree(newgenfs);				goto bad;			}			if (strcmp(newgenfs->fstype, genfs->fstype) < 0)				break;		}		newgenfs->next = genfs;		if (genfs_p)			genfs_p->next = newgenfs;		else			p->genfs = newgenfs;		rc = next_entry(buf, fp, sizeof(u32));		if (rc < 0)			goto bad;		nel2 = le32_to_cpu(buf[0]);		for (j = 0; j < nel2; j++) {			rc = next_entry(buf, fp, sizeof(u32));			if (rc < 0)				goto bad;			len = le32_to_cpu(buf[0]);			newc = kmalloc(sizeof(*newc), GFP_KERNEL);			if (!newc) {				rc = -ENOMEM;				goto bad;			}			memset(newc, 0, sizeof(*newc));			newc->u.name = kmalloc(len + 1,GFP_KERNEL);			if (!newc->u.name) {				rc = -ENOMEM;				goto bad_newc;			}			rc = next_entry(newc->u.name, fp, len);			if (rc < 0)				goto bad_newc;			newc->u.name[len] = 0;			rc = next_entry(buf, fp, sizeof(u32));			if (rc < 0)				goto bad_newc;			newc->v.sclass = le32_to_cpu(buf[0]);			if (context_read_and_validate(&newc->context[0], p, fp))				goto bad_newc;			for (l = NULL, c = newgenfs->head; c;			     l = c, c = c->next) {				if (!strcmp(newc->u.name, c->u.name) &&				    (!c->v.sclass || !newc->v.sclass ||				     newc->v.sclass == c->v.sclass)) {					printk(KERN_ERR "security:  dup genfs "					       "entry (%s,%s)\n",					       newgenfs->fstype, c->u.name);					goto bad_newc;				}				len = strlen(newc->u.name);				len2 = strlen(c->u.name);				if (len > len2)					break;			}			newc->next = c;			if (l)				l->next = newc;			else				newgenfs->head = newc;		}	}	if (p->policyvers >= POLICYDB_VERSION_MLS) {		rc = next_entry(buf, fp, sizeof(u32));		if (rc < 0)			goto bad;		nel = le32_to_cpu(buf[0]);		lrt = NULL;		for (i = 0; i < nel; i++) {			rt = kmalloc(sizeof(*rt), GFP_KERNEL);			if (!rt) {				rc = -ENOMEM;				goto bad;			}			memset(rt, 0, sizeof(*rt));			if (lrt)				lrt->next = rt;			else				p->range_tr = rt;			rc = next_entry(buf, fp, (sizeof(u32) * 2));			if (rc < 0)				goto bad;			rt->dom = le32_to_cpu(buf[0]);			rt->type = le32_to_cpu(buf[1]);			rc = mls_read_range_helper(&rt->range, fp);			if (rc)				goto bad;			lrt = rt;		}	}	p->type_attr_map = kmalloc(p->p_types.nprim*sizeof(struct ebitmap), GFP_KERNEL);	if (!p->type_attr_map)		goto bad;	for (i = 0; i < p->p_types.nprim; i++) {		ebitmap_init(&p->type_attr_map[i]);		if (p->policyvers >= POLICYDB_VERSION_AVTAB) {			if (ebitmap_read(&p->type_attr_map[i], fp))				goto bad;		}		/* add the type itself as the degenerate case */		if (ebitmap_set_bit(&p->type_attr_map[i], i, 1))				goto bad;	}	rc = 0;out:	return rc;bad_newc:	ocontext_destroy(newc,OCON_FSUSE);bad:	if (!rc)		rc = -EINVAL;	policydb_destroy(p);	goto out;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/b5bf6c55edf94e9c7fc01724d5b271f78eaf1d3f/policydb.c/buggy/security/selinux/ss/policydb.c