The following patch fixes the problem.
scontext is allocated by matchpathcon(3) and needs to be freed by the caller.
If it's not set to NULL before the attempted allocation then it'll keep the
previous value (which had been freed) and then you get a double-free.
--- dpkg-1.14.16.6.orig/src/archives.c
+++ dpkg-1.14.16.6/src/archives.c
@@ -629,6 +629,7 @@
* or if it has no context; in which case the default
* context shall be applied.
*/
+ scontext = NULL;
if( ! ((matchpathcon(fnamevb.buf,
(nifd->namenode->statoverride ?
nifd->namenode->statoverride->mode : ti->Mode)
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
