diff --git a/tools/sepolicy-analyze/neverallow.c b/tools/sepolicy-analyze/neverallow.c index a55a92171..745ab1333 100644 --- a/tools/sepolicy-analyze/neverallow.c +++ b/tools/sepolicy-analyze/neverallow.c @@ -382,21 +382,25 @@ static int check_neverallows(policydb_t *policydb, char *text, char *end) char *p, *start; int result; + int non_comment_len = 0, cur_non_comment_len = 0; + char *cur_non_comment_text = calloc(1, (end - text) + 1); + char *non_comment_text = cur_non_comment_text; + if (!cur_non_comment_text) + goto err; p = text; + bool in_comment = false; while (p < end) { - while (p < end && isspace(*p)) - p++; - - if (*p == '#') { - while (p < end && *p != '\n') - p++; - continue; - } - + if (*p == '#') in_comment = true; + if (!in_comment || *p == '\n') *cur_non_comment_text++ = *p; + if (*p == '\n') in_comment = false; + ++p; + } + p = non_comment_text; + end = cur_non_comment_text; + while (p < end) { + while (p < end && isspace(*p)) p++; start = p; - while (p < end && !isspace(*p)) - p++; - + while (p < end && !isspace(*p)) p++; len = p - start; if (len != keyword_size || strncmp(start, keyword, keyword_size)) continue; @@ -437,8 +441,10 @@ static int check_neverallows(policydb_t *policydb, char *text, char *end) result = check_assertions(NULL, policydb, neverallows); avrule_list_destroy(neverallows); + free(non_comment_text); return result; err: + free(non_comment_text); if (errno == ENOMEM) { fprintf(stderr, "Out of memory while parsing neverallow rules\n"); } else