[PATCH 02/11] apparmor: fix memory leak in verify_header
authorMassimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Tue, 20 Jan 2026 14:24:04 +0000 (15:24 +0100)
committerSalvatore Bonaccorso <carnil@debian.org>
Thu, 12 Mar 2026 12:28:10 +0000 (13:28 +0100)
commite41e40417d52efe6c5569ba6272ada6812b73fef
tree831d902f1545bd1c5b0fedd774cc1538b121ca63
parentd5afde2047a080938db555870874fa671753cca1
[PATCH 02/11] apparmor: fix memory leak in verify_header

The function sets `*ns = NULL` on every call, leaking the namespace
string allocated in previous iterations when multiple profiles are
unpacked. This also breaks namespace consistency checking since *ns
is always NULL when the comparison is made.

Remove the incorrect assignment.
The caller (aa_unpack) initializes *ns to NULL once before the loop,
which is sufficient.

Fixes: dd51c8485763 ("apparmor: provide base for multiple profiles to be replaced at once")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Gbp-Pq: Topic bugfix/all/qsa-2026-apparmor
Gbp-Pq: Name 0002-apparmor-fix-memory-leak-in-verify_header.patch
security/apparmor/policy_unpack.c