[Open-scap] Need help with dpkg probe dev

[Daniel Kopecek]

On 08/04/2011 09:51 PM, Pierre Chifflier wrote:
> Hi,
> 
> I am trying to update the dpkginfo probe to the current probe API
> version, and have a problem when running an eval:
> 
> ./utils/oscap oval eval --results res.xml oval-2011-08-03.16.24.30.xml
> Definition oval:org.mitre.oval:def:6513: false
> ERROR: Unable to close probe sd
> 
> The debug file (attached) does not give more details on what is
> happening.
> 
> The code of the probe is inspired from the rpminfo, and I cannot find
> why the probe fails.

OK, I think I have found the problem. The recently added API function:

int probe_item_collect(probe_ctx *ctx, SEXP_t *item);

takes care of releasing the reference to the item. So the following
call to SEXP_free is wrong in your code and leads to a double-free.

...
			probe_item_collect(ctx, item);
                        SEXP_free (item);

                        dpkginfo_free_reply(dpkginfo_reply);
                }
...

This behavior is described in a comment above the function declaration
in src/OVAL/probes/public/probe-api.h and I think it should be visible
in the generated doxygen documentation. However, I'll check whether this
is true and fix it if it's not there.

Dan K.