|
 |
02a573 |
From 378ef5e438a2f5af7a50374d2bd23bdd3403201f Mon Sep 17 00:00:00 2001
|
|
|
02a573 |
From: Evgeny Kolesnikov <ekolesni@redhat.com>
|
|
|
02a573 |
Date: Tue, 4 May 2021 08:41:06 +0200
|
|
|
02a573 |
Subject: [PATCH] Fix covscan-reported issues in yamlfilecontent probe and
|
|
|
02a573 |
schematron
|
|
|
02a573 |
|
|
|
02a573 |
Error: FORWARD_NULL (CWE-476): [#def1]
|
|
|
02a573 |
/OVAL/probes/independent/yamlfilecontent_probe.c:392: var_compare_op: Comparing "yaml_file" to null implies that "yaml_file" might be null.
|
|
|
02a573 |
/OVAL/probes/independent/yamlfilecontent_probe.c:417: var_deref_model: Passing null pointer "yaml_file" to "fclose", which dereferences it.
|
|
|
02a573 |
# 416| cleanup:
|
|
|
02a573 |
# 417|-> fclose(yaml_file);
|
|
|
02a573 |
# 418| yaml_parser_delete(&parser);
|
|
|
02a573 |
|
|
|
02a573 |
Error: RESOURCE_LEAK (CWE-772): [#def2] [important]
|
|
|
02a573 |
/source/schematron.c:549: alloc_fn: Storage is returned from allocation function "xmlXPathNodeEval".
|
|
|
02a573 |
/source/schematron.c:549: var_assign: Assigning: "component_refs" = storage returned from "xmlXPathNodeEval(data_stream_node, (xmlChar *)"ds:checklists/ds:component-ref", context)".
|
|
|
02a573 |
/source/schematron.c:551: leaked_storage: Variable "component_refs" going out of scope leaks the storage it points to.
|
|
|
02a573 |
# 550| if (component_refs == NULL || component_refs->nodesetval == NULL) {
|
|
|
02a573 |
# 551|-> return res;
|
|
|
02a573 |
# 552| }
|
|
|
02a573 |
---
|
|
|
02a573 |
src/OVAL/probes/independent/yamlfilecontent_probe.c | 3 ++-
|
|
|
02a573 |
src/source/schematron.c | 2 ++
|
|
|
02a573 |
2 files changed, 4 insertions(+), 1 deletion(-)
|
|
|
02a573 |
|
|
|
02a573 |
diff --git a/src/OVAL/probes/independent/yamlfilecontent_probe.c b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
|
|
02a573 |
index ed5ce0d68..62a8f4ff2 100644
|
|
|
02a573 |
--- a/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
|
|
02a573 |
+++ b/src/OVAL/probes/independent/yamlfilecontent_probe.c
|
|
|
02a573 |
@@ -414,7 +414,8 @@ static int process_yaml_file(const char *prefix, const char *path, const char *f
|
|
|
02a573 |
}
|
|
|
02a573 |
|
|
|
02a573 |
cleanup:
|
|
|
02a573 |
- fclose(yaml_file);
|
|
|
02a573 |
+ if (yaml_file != NULL)
|
|
|
02a573 |
+ fclose(yaml_file);
|
|
|
02a573 |
yaml_parser_delete(&parser);
|
|
|
02a573 |
free(filepath_with_prefix);
|
|
|
02a573 |
free(filepath);
|
|
|
02a573 |
diff --git a/src/source/schematron.c b/src/source/schematron.c
|
|
|
02a573 |
index 6cb22658b..c32d5aed6 100644
|
|
|
02a573 |
--- a/src/source/schematron.c
|
|
|
02a573 |
+++ b/src/source/schematron.c
|
|
|
02a573 |
@@ -548,6 +548,8 @@ static bool _req_src_346_1_sub1(xmlNodePtr data_stream_node, xmlXPathContextPtr
|
|
|
02a573 |
/* every $m in ds:checklists/ds:component-ref satisfies ... */
|
|
|
02a573 |
xmlXPathObjectPtr component_refs = xmlXPathNodeEval(data_stream_node, BAD_CAST "ds:checklists/ds:component-ref", context);
|
|
|
02a573 |
if (component_refs == NULL || component_refs->nodesetval == NULL) {
|
|
|
02a573 |
+ if (component_refs != NULL)
|
|
|
02a573 |
+ xmlXPathFreeObject(component_refs);
|
|
|
02a573 |
return res;
|
|
|
02a573 |
}
|
|
|
02a573 |
for (int i = 0; i < component_refs->nodesetval->nodeNr; i++) {
|