Skip to content

Commit 1171255

Browse files
jan-cernyjan-cerny
authored
Merge pull request #1221 from jan-cerny/master
Merge maint-1.2
2 parents a1f3f68 + c3401fb commit 1171255

File tree

11 files changed

+152
-94
lines changed

11 files changed

+152
-94
lines changed

‎src/CVRF/cvrf_priv.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1659,7 +1659,9 @@ struct cvrf_score_set *cvrf_score_set_parse(xmlTextReaderPtr reader) {
16591659
if (xmlStrcmp(xmlTextReaderConstLocalName(reader), TAG_VECTOR) == 0) {
16601660
score_set->vector = oscap_element_string_copy(reader);
16611661
} else if (xmlStrcmp(xmlTextReaderConstLocalName(reader), TAG_PRODUCT_ID) == 0) {
1662-
oscap_stringlist_add_string(score_set->product_ids, oscap_element_string_copy(reader));
1662+
char *product_id = oscap_element_string_copy(reader);
1663+
oscap_stringlist_add_string(score_set->product_ids, product_id);
1664+
free(product_id);
16631665
} else if (xmlStrcmp(xmlTextReaderConstLocalName(reader), TAG_BASE_SCORE) == 0) {
16641666
cvrf_score_set_add_metric(score_set, CVSS_BASE, oscap_element_string_copy(reader));
16651667
} else if (xmlStrcmp(xmlTextReaderConstLocalName(reader), TAG_ENVIRONMENTAL_SCORE) == 0) {
@@ -2336,7 +2338,6 @@ struct cvrf_index *cvrf_index_parse_xml(struct oscap_source *index_source) {
23362338
}
23372339
struct cvrf_index *index = cvrf_index_new();
23382340
cvrf_index_set_index_file(index, oscap_source_readable_origin(index_source));
2339-
oscap_source_free(index_source);
23402341
return index;
23412342
}
23422343

‎src/OVAL/probes/SEAP/seap-command-backendS.c

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,20 @@ static Stable_t *Stable_new (size_t capacity)
8585
return (t);
8686
}
8787

88+
static void Stable_free(Stable_t *table)
89+
{
90+
size_t i;
91+
if (table != NULL) {
92+
for (i = 0; i < table->t_size; ++i) {
93+
if (table->t_recs[i].c_size > 0)
94+
free(table->t_recs[i].c_recs);
95+
}
96+
97+
free(table->t_recs);
98+
free(table);
99+
}
100+
}
101+
88102
static int Stable_add (Stable_t *t, SEAP_cmdrec_t *r)
89103
{
90104
Stable_rec_t *t_r;
@@ -137,10 +151,11 @@ int SEAP_cmdtbl_backendS_add (SEAP_cmdtbl_t *t, SEAP_cmdrec_t *r)
137151
n = Stable_new (SEAP_CMDTBL_LARGE_TRESHOLD);
138152
ret = SEAP_cmdtbl_backendL_apply (t, &Stable_conv, (void *)n);
139153

140-
if (ret != 0) {
141-
SEAP_cmdtbl_backendS_free (t);
142-
return (ret);
143-
}
154+
if (ret != 0) {
155+
SEAP_cmdtbl_backendS_free(t);
156+
Stable_free(n);
157+
return ret;
158+
}
144159

145160
SEAP_cmdtbl_backendL_free (t);
146161
t->table = n;
@@ -179,24 +194,16 @@ int SEAP_cmdtbl_backendS_cmp (SEAP_cmdrec_t *a, SEAP_cmdrec_t *b)
179194
return (a->code - b->code);
180195
}
181196

182-
void SEAP_cmdtbl_backendS_free (SEAP_cmdtbl_t *t)
197+
void SEAP_cmdtbl_backendS_free(SEAP_cmdtbl_t *t)
183198
{
184-
size_t i;
185199
Stable_t *St;
186-
200+
187201
St = (Stable_t *)(t->table);
188-
189-
if (St != NULL) {
190-
for (i = 0; i < St->t_size; ++i)
191-
if (St->t_recs[i].c_size > 0)
192-
free(St->t_recs[i].c_recs);
193-
194-
free(St->t_recs);
195-
free(St);
196-
197-
t->table = NULL;
198-
}
199-
return;
202+
203+
if (St != NULL) {
204+
Stable_free(St);
205+
t->table = NULL;
206+
}
200207
}
201208

202209
int SEAP_cmdtbl_backendS_apply (SEAP_cmdtbl_t *t, int (*func) (SEAP_cmdrec_t *r, void *), void *arg)

‎src/OVAL/probes/SEAP/seap-command.c

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -226,10 +226,10 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
226226
SEAP_cmdfn_t func,
227227
void *funcarg)
228228
{
229-
SEAP_desc_t *dsc;
230-
SEAP_cmdrec_t *rec;
229+
SEAP_desc_t *dsc = NULL;
230+
SEAP_cmdrec_t *rec = NULL;
231231
SEAP_cmdtbl_t *tbl[2];
232-
SEXP_t *res;
232+
SEXP_t *res = NULL;
233233
int8_t i;
234234

235235
_A(ctx != NULL);
@@ -343,14 +343,17 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
343343
dI("Can't register async command handler: id=%u, tbl=%p, sd=%u: already registered.",
344344
rec->code, (void *)dsc->cmd_w_table, sd);
345345
SEAP_cmdrec_free (rec);
346+
SEAP_packet_free(packet);
346347
return (NULL);
347348
case -1:
348349
dI("Can't register async command handler: id=%u, tbl=%p, sd=%u: errno=%u, %s.",
349350
rec->code, (void *)dsc->cmd_w_table, sd, errno, strerror (errno));
350351
SEAP_cmdrec_free (rec);
352+
SEAP_packet_free(packet);
351353
return (NULL);
352354
default:
353355
SEAP_cmdrec_free (rec);
356+
SEAP_packet_free(packet);
354357
errno = EDOOFUS;
355358
return (NULL);
356359
}
@@ -359,7 +362,7 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
359362
protect_errno {
360363
dI("FAIL: errno=%u, %s.", errno, strerror (errno));
361364
SEAP_cmdtbl_del(dsc->cmd_w_table, rec);
362-
SEAP_packet_free (packet);
365+
SEAP_packet_free(packet);
363366
}
364367
return (NULL);
365368
}
@@ -384,6 +387,7 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
384387

385388
if (SEAP_packet_recv(ctx, sd, &packet_rcv) != 0) {
386389
dI("FAIL: ctx=%p, sd=%d, errno=%u, %s.", ctx, sd, errno, strerror(errno));
390+
SEAP_packet_free(packet);
387391
return(NULL);
388392
}
389393

@@ -394,6 +398,7 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
394398
SEAP_packet_free(packet_rcv);
395399
break;
396400
default:
401+
SEAP_packet_free(packet);
397402
errno = EDOOFUS;
398403
return(NULL);
399404
}
@@ -440,7 +445,7 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
440445
pthread_mutex_unlock (&(h.mtx));
441446
pthread_cond_destroy (&(h.cond));
442447
pthread_mutex_destroy (&(h.mtx));
443-
SEAP_packet_free (packet);
448+
SEAP_packet_free(packet);
444449

445450
return (res);
446451
}
@@ -460,14 +465,17 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
460465
dI("Can't register async command handler: id=%u, tbl=%p, sd=%u: already registered.",
461466
rec->code, (void *)dsc->cmd_w_table, sd);
462467
SEAP_cmdrec_free (rec);
468+
SEAP_packet_free(packet);
463469
return (NULL);
464470
case -1:
465471
dI("Can't register async command handler: id=%u, tbl=%p, sd=%u: errno=%u, %s.",
466472
rec->code, (void *)dsc->cmd_w_table, sd, errno, strerror (errno));
467-
SEAP_cmdrec_free (rec);
473+
SEAP_cmdrec_free(rec);
474+
SEAP_packet_free(packet);
468475
return (NULL);
469476
default:
470-
SEAP_cmdrec_free (rec);
477+
SEAP_cmdrec_free(rec);
478+
SEAP_packet_free(packet);
471479
errno = EDOOFUS;
472480
return (NULL);
473481
}
@@ -476,17 +484,17 @@ SEXP_t *SEAP_cmd_exec (SEAP_CTX_t *ctx,
476484
protect_errno {
477485
dI("FAIL: errno=%u, %s.", errno, strerror (errno));
478486
SEAP_cmdtbl_del(dsc->cmd_w_table, rec);
479-
SEAP_cmdrec_free(rec);
480-
SEAP_packet_free (packet);
487+
SEAP_packet_free(packet);
481488
}
482489
return (NULL);
483490
}
484491

485-
SEAP_packet_free (packet);
492+
SEAP_packet_free(packet);
486493

487494
return (args);
488495
default:
489496
errno = EINVAL;
497+
SEAP_packet_free(packet);
490498
return (NULL);
491499
}
492500
}

‎src/OVAL/probes/SEAP/sexp-manip.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -931,7 +931,10 @@ SEXP_t *SEXP_list_new (SEXP_t *memb, ...)
931931

932932
va_start(ap, memb);
933933
list = SEXP_new ();
934-
list = SEXP_list_new_rv(list, memb, ap);
934+
if (SEXP_list_new_rv(list, memb, ap) == NULL) {
935+
SEXP_free(list);
936+
list = NULL;
937+
}
935938
va_end(ap);
936939

937940
return (list);
@@ -1034,7 +1037,10 @@ SEXP_t *SEXP_list_rest (const SEXP_t *list)
10341037
SEXP_t *sexp;
10351038

10361039
sexp = SEXP_new();
1037-
sexp = SEXP_list_rest_r(sexp, list);
1040+
if (SEXP_list_rest_r(sexp, list) == NULL) {
1041+
SEXP_free(sexp);
1042+
sexp = NULL;
1043+
}
10381044

10391045
return (sexp);
10401046
}

‎src/OVAL/probes/independent/textfilecontent54_probe.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,8 @@ static SEXP_t *create_item(const char *path, const char *filename, char *pattern
162162
SEXP_free (r0);
163163
}
164164

165+
SEXP_free(se_filepath);
166+
SEXP_free(se_instance);
165167
return item;
166168
}
167169

@@ -311,7 +313,6 @@ int textfilecontent54_probe_main(probe_ctx *ctx, void *arg)
311313
{
312314
SEXP_t *path_ent, *file_ent, *inst_ent, *bh_ent, *patt_ent, *filepath_ent, *probe_in;
313315
SEXP_t *r0;
314-
/* char *i_val, *m_val, *s_val; */
315316
bool val;
316317
struct pfdata pfd;
317318
int ret = 0;
@@ -354,11 +355,6 @@ int textfilecontent54_probe_main(probe_ctx *ctx, void *arg)
354355
goto cleanup;
355356
}
356357

357-
/* wtf?
358-
i_val = s_val = "0";
359-
m_val = "1";
360-
*/
361-
362358
/* reset filebehavior attributes if 'filepath' entity is used */
363359
if (filepath_ent != NULL && bh_ent != NULL) {
364360
SEXP_t *r1, *r2, *r3;

‎src/OVAL/probes/probe-api.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1407,6 +1407,11 @@ static SEXP_t *probe_item_optimize(const SEXP_t *item)
14071407
return SEXP_ref(item);
14081408
}
14091409

1410+
/**
1411+
* The order of (value_name, value_type, *value) argument tuples passed as
1412+
* e.g. 3rd to 5th arguments matters. If you change ordering of those tuples,
1413+
* it will have consequences.
1414+
*/
14101415
SEXP_t *probe_item_create(oval_subtype_t item_subtype, probe_elmatr_t *item_attributes[],
14111416
/* const char *value_name, oval_datatype_t value_type, void *value, */ ...)
14121417
{

‎src/OVAL/probes/unix/linux/selinuxsecuritycontext_probe.c

Lines changed: 62 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,66 @@ static void split_range(const char *range, char **l_s, char **l_c, char **h_s, c
104104
}
105105
}
106106

107+
static SEXP_t *create_process_probe_item_with_range(
108+
const char *range, const char *user, const char *role, const char *type,
109+
int pid_number) {
110+
char *l_sensitivity, *l_category, *h_sensitivity, *h_category;
111+
SEXP_t *item;
112+
113+
split_range(range, &l_sensitivity, &l_category, &h_sensitivity, &h_category);
114+
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,
115+
"pid", OVAL_DATATYPE_INTEGER, (int64_t)pid_number,
116+
117+
"user", OVAL_DATATYPE_STRING, user,
118+
"role", OVAL_DATATYPE_STRING, role,
119+
"type", OVAL_DATATYPE_STRING, type,
120+
"low_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
121+
"low_category", OVAL_DATATYPE_STRING, l_category,
122+
"high_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
123+
"high_category", OVAL_DATATYPE_STRING, h_category,
124+
NULL);
125+
free(l_sensitivity);
126+
free(l_category);
127+
free(h_sensitivity);
128+
free(h_category);
129+
130+
return item;
131+
}
132+
133+
134+
static SEXP_t *create_file_probe_item_with_range(
135+
const char *range, const char *user, const char *role, const char *type,
136+
const char *pbuf, const char *p, const char *f) {
137+
char *l_sensitivity, *l_category, *h_sensitivity, *h_category;
138+
SEXP_t *item;
139+
140+
split_range(range, &l_sensitivity, &l_category, &h_sensitivity, &h_category);
141+
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,
142+
"filepath", OVAL_DATATYPE_STRING, pbuf,
143+
"path", OVAL_DATATYPE_STRING, p,
144+
"filename", OVAL_DATATYPE_STRING, f,
145+
146+
"user", OVAL_DATATYPE_STRING, user,
147+
"role", OVAL_DATATYPE_STRING, role,
148+
"type", OVAL_DATATYPE_STRING, type,
149+
"low_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
150+
"low_category", OVAL_DATATYPE_STRING, l_category,
151+
"high_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
152+
"high_category", OVAL_DATATYPE_STRING, h_category,
153+
154+
"rawlow_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
155+
"rawlow_category", OVAL_DATATYPE_STRING, l_category,
156+
"rawhigh_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
157+
"rawhigh_category", OVAL_DATATYPE_STRING, h_category,
158+
NULL);
159+
free(l_sensitivity);
160+
free(l_category);
161+
free(h_sensitivity);
162+
free(h_category);
163+
164+
return item;
165+
}
166+
107167
static int selinuxsecuritycontext_process_cb (SEXP_t *pid_ent, probe_ctx *ctx) {
108168

109169
SEXP_t *pid_sexp, *item;
@@ -113,7 +173,6 @@ static int selinuxsecuritycontext_process_cb (SEXP_t *pid_ent, probe_ctx *ctx) {
113173
DIR *proc;
114174
struct dirent *dir_entry;
115175
const char *user, *role, *type, *range;
116-
char *l_sensitivity, *l_category, *h_sensitivity, *h_category;
117176

118177
if ((proc = opendir("/proc")) == NULL) {
119178
dE("Can't open /proc dir: %s", strerror(errno));
@@ -144,17 +203,7 @@ static int selinuxsecuritycontext_process_cb (SEXP_t *pid_ent, probe_ctx *ctx) {
144203
type = context_type_get(context);
145204
range = context_range_get(context);
146205
if (range != NULL) {
147-
split_range(range, &l_sensitivity, &l_category, &h_sensitivity, &h_category);
148-
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,
149-
"pid", OVAL_DATATYPE_INTEGER, (int64_t)pid_number,
150-
"user", OVAL_DATATYPE_STRING, user,
151-
"role", OVAL_DATATYPE_STRING, role,
152-
"type", OVAL_DATATYPE_STRING, type,
153-
"low_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
154-
"low_category", OVAL_DATATYPE_STRING, l_category,
155-
"high_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
156-
"high_category", OVAL_DATATYPE_STRING, h_category,
157-
NULL);
206+
item = create_process_probe_item_with_range(range, user, role, type, pid_number);
158207
}
159208
else {
160209
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,
@@ -189,7 +238,6 @@ static int selinuxsecuritycontext_file_cb(const char *prefix, const char *p, con
189238
int file_context_size;
190239
context_t context;
191240
const char *user, *role, *type, *range;
192-
char *l_sensitivity, *l_category, *h_sensitivity, *h_category;
193241
int err = 0;
194242

195243
/* directory */
@@ -245,23 +293,7 @@ static int selinuxsecuritycontext_file_cb(const char *prefix, const char *p, con
245293
range = context_range_get(context);
246294

247295
if (range != NULL) {
248-
split_range(range, &l_sensitivity, &l_category, &h_sensitivity, &h_category);
249-
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,
250-
"filepath", OVAL_DATATYPE_STRING, pbuf,
251-
"path", OVAL_DATATYPE_STRING, p,
252-
"filename", OVAL_DATATYPE_STRING, f,
253-
"user", OVAL_DATATYPE_STRING, user,
254-
"role", OVAL_DATATYPE_STRING, role,
255-
"type", OVAL_DATATYPE_STRING, type,
256-
"low_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
257-
"low_category", OVAL_DATATYPE_STRING, l_category,
258-
"high_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
259-
"high_category", OVAL_DATATYPE_STRING, h_category,
260-
"rawlow_sensitivity", OVAL_DATATYPE_STRING, l_sensitivity,
261-
"rawlow_category", OVAL_DATATYPE_STRING, l_category,
262-
"rawhigh_sensitivity", OVAL_DATATYPE_STRING, h_sensitivity,
263-
"rawhigh_category", OVAL_DATATYPE_STRING, h_category,
264-
NULL);
296+
item = create_file_probe_item_with_range(range, user, role, type, pbuf, p, f);
265297
}
266298
else {
267299
item = probe_item_create(OVAL_LINUX_SELINUXSECURITYCONTEXT, NULL,

‎src/OVAL/probes/unix/process_probe.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,9 @@ static void report_finding(struct result_info *res, probe_ctx *ctx)
9797
"tty", OVAL_DATATYPE_STRING, res->tty,
9898
"user_id", OVAL_DATATYPE_INTEGER, (int64_t)res->user_id,
9999
NULL);
100+
if (se_ruid) {
101+
SEXP_free(se_ruid);
102+
}
100103

101104
probe_item_collect(ctx, item);
102105
}

0 commit comments

Comments
 (0)