Fix a bug where context components were accessed after the contex was freed.

1 files changed, 12 insertions, 14 deletions

diff --git a/src/mcscolor.c b/src/mcscolor.c
index 705006e..06d6880 100644
--- a/src/mcscolor.c
+++ b/src/mcscolor.c
@@ -160,22 +160,16 @@ static const unsigned precedence[N_COLOR][N_COLOR] = {
 
 static const secolor_t default_color = { 0x000000, 0xffffff };
 
-static int parse_context(const security_context_t raw, char **components)
+static int parse_components(context_t con, char **components)
 {
-	context_t con;
 	char *range, *tmp;
 
-	components[COLOR_LEVEL] = NULL;
-	components[COLOR_SENS] = NULL;
-	components[COLOR_RANGE] = NULL;
-
-	con = context_new(raw);
-	if (!con)
-		return -1;
-
 	components[COLOR_USER] = (char *)context_user_get(con);
 	components[COLOR_ROLE] = (char *)context_role_get(con);
 	components[COLOR_TYPE] = (char *)context_type_get(con);
+	components[COLOR_LEVEL] = NULL;
+	components[COLOR_SENS] = NULL;
+	components[COLOR_RANGE] = NULL;
 
 	range = (char *)context_range_get(con);
 	if (range) {
@@ -194,20 +188,21 @@ static int parse_context(const security_context_t raw, char **components)
 		components[COLOR_LEVEL] = strdup(range);
 	}
 
-	context_free(con);
 	return 0;
 }
 
-static void free_context(char **components)
+static void free_components(context_t con, char **components)
 {
 	free(components[COLOR_RANGE]);
 	free(components[COLOR_LEVEL]);
 	free(components[COLOR_SENS]);
+	context_free(con);
 }
 
 /* Look up colors.
  */
 int raw_color(const security_context_t raw, char **color_str) {
+	context_t con;
 	uint32_t i, j, mask = 0;
 	const secolor_t *items[N_RULES];
 	char *result, *components[N_RULES];
@@ -215,7 +210,10 @@ int raw_color(const security_context_t raw, char **color_str) {
 	int rc = -1;
 
 	/* parse context and allocate memory */
-	if (parse_context(raw, components) < 0)
+	con = context_new(raw);
+	if (!con)
+		return -1;
+	if (parse_components(con, components) < 0)
 		goto out;
 
 	result = malloc(N_COLOR * sizeof(buf));
@@ -253,6 +251,6 @@ int raw_color(const security_context_t raw, char **color_str) {
 	*color_str = result;
 	rc = 0;
 out:
-	free_context(components);
+	free_components(con, components);
 	return rc;
 }