From f141dfd0311ec2be4c4c27814d9d6693551cfd76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 27 Jan 2022 15:00:33 +0100 Subject: [PATCH 1/3] Fix shellcheck warning Addressing: Error: SHELLCHECK_WARNING (CWE-138): [#def1] /usr/libexec/oscap-remediate:110:12: error[SC2145]: Argument mixes string and array. Use * or separate argument. 108| args+=( "--remediate" ) 109| args+=( "${OSCAP_REMEDIATE_DS}" ) 110|-> log "Args: ${args[@]}" 111| 112| # Now we are good to go --- utils/oscap-remediate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/utils/oscap-remediate b/utils/oscap-remediate index fc0b7715f..52e29aa66 100755 --- a/utils/oscap-remediate +++ b/utils/oscap-remediate @@ -107,7 +107,7 @@ args+=( ${OSCAP_REMEDIATE_HTML_REPORT:+"--report=${OSCAP_REMEDIATE_HTML_REPORT}" args+=( "--progress-full" ) args+=( "--remediate" ) args+=( "${OSCAP_REMEDIATE_DS}" ) -log "Args: ${args[@]}" +log "Args: ${args[*]}" # Now we are good to go header="OpenSCAP is checking the system for compliance using"$'\n'"${profile_title}"$'\n\n'"Evaluating..." From d3e7d5be1fcd55ef396de6070f877df0f2c2c58e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 27 Jan 2022 15:09:02 +0100 Subject: [PATCH 2/3] Remove superfluous strdup We can do this because xccdf_session_set_rule calls strdup on the rule parameter internally. Addressing: Error: RESOURCE_LEAK (CWE-772): [#def2] [important] openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: alloc_fn: Storage is returned from allocation function "strdup". openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4148: var_assign: Assigning: "n_rule" = storage returned from "strdup(rule)". openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4149: noescape: Resource "n_rule" is not freed or pointed-to in "xccdf_session_set_rule". openscap-1.3.6/build/swig/python3/CMakeFiles/_openscap_py.dir/openscapPYTHON_wrap.c:4150: leaked_storage: Variable "n_rule" going out of scope leaks the storage it points to. 4148| char *n_rule = strdup(rule); 4149| xccdf_session_set_rule(sess, n_rule); 4150|-> } 4151| 4152| void xccdf_session_free_py(struct xccdf_session *sess){ --- swig/openscap.i | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/swig/openscap.i b/swig/openscap.i index 2fe1cce99..158a22675 100644 --- a/swig/openscap.i +++ b/swig/openscap.i @@ -559,8 +559,7 @@ struct xccdf_session { }; void xccdf_session_set_rule_py(struct xccdf_session *sess, char *rule) { - char *n_rule = strdup(rule); - xccdf_session_set_rule(sess, n_rule); + xccdf_session_set_rule(sess, rule); } void xccdf_session_free_py(struct xccdf_session *sess){ From 6ef54336a018566a32f6a95177635ada7f20794e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20=C4=8Cern=C3=BD?= Date: Thu, 27 Jan 2022 15:16:02 +0100 Subject: [PATCH 3/3] Add a missing free Addressing: Error: RESOURCE_LEAK (CWE-772): [#def4] [important] openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: alloc_fn: Storage is returned from allocation function "oscap_htable_iterator_new". openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2144: var_assign: Assigning: "rit" = storage returned from "oscap_htable_iterator_new(policy->rules)". openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2145: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_has_more". openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2146: noescape: Resource "rit" is not freed or pointed-to in "oscap_htable_iterator_next_key". openscap-1.3.6/src/XCCDF_POLICY/xccdf_policy.c:2150: leaked_storage: Variable "rit" going out of scope leaks the storage it points to. 2148| oscap_seterr(OSCAP_EFAMILY_XCCDF, 2149| "Rule '%s' not found in selected profile.", rule_id); 2150|-> return NULL; 2151| } 2152| } --- src/XCCDF_POLICY/xccdf_policy.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c index b63853a38..4d4b7ad0a 100644 --- a/src/XCCDF_POLICY/xccdf_policy.c +++ b/src/XCCDF_POLICY/xccdf_policy.c @@ -2147,6 +2147,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy) if (oscap_htable_get(policy->rules_found, rule_id) == NULL) { oscap_seterr(OSCAP_EFAMILY_XCCDF, "Rule '%s' not found in selected profile.", rule_id); + oscap_htable_iterator_free(rit); return NULL; } }