From d6f07fdb8bd44c038117aa74b58c505157069a38 Mon Sep 17 00:00:00 2001 From: David du Colombier Date: Tue, 20 Oct 2026 23:29:15 +0200 Subject: [PATCH] Free the TestResult of an evaluation that names an unknown rule xccdf_policy_evaluate returns NULL when a rule selected with --rule or xccdf_session_add_rule matches no rule of the benchmark, and it left behind the TestResult it had filled with a notselected result for every rule. A long-lived caller that evaluates rules on request lost one per such request. Under valgrind --leak-check=full, the unknown rule case of test_single_rule.sh, oscap xccdf eval --rule xccdf_non_existent test_single_rule.xccdf.xml loses on main the TestResult of the two rules of that benchmark: 1,540 (296 direct, 1,244 indirect) bytes in 1 blocks are definitely lost at calloc (vg_replace_malloc.c:1616) by xccdf_item_new (item.c:127) by xccdf_result_new (result.c:123) by xccdf_policy_evaluate (xccdf_policy.c:2167) With this change valgrind reports 0 bytes definitely or indirectly lost. --- src/XCCDF_POLICY/xccdf_policy.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/XCCDF_POLICY/xccdf_policy.c b/src/XCCDF_POLICY/xccdf_policy.c index 44e26f452c..1e6dba9c6d 100644 --- a/src/XCCDF_POLICY/xccdf_policy.c +++ b/src/XCCDF_POLICY/xccdf_policy.c @@ -2208,6 +2208,7 @@ struct xccdf_result * xccdf_policy_evaluate(struct xccdf_policy * policy) oscap_seterr(OSCAP_EFAMILY_XCCDF, "Rule '%s' not found in selected profile.", rule_id); oscap_htable_iterator_free(rit); + xccdf_result_free(result); return NULL; } }