Bug 1911999

Created attachment 1743798 [details]
Latest archive from DoD

Description of problem:

Latest XML file is available here:
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_7_V3R1_STIG_SCAP_1-2_Benchmark.zip

When executing a run with --stig-viewer option against the XML file extracted from archive above (added to the BZ for convenience), oscap segfaults:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# oscap xccdf eval --profile xccdf_mil.disa.stig_profile_MAC-2_Sensitive --rule xccdf_mil.disa.stig_rule_SV-204393r505924_rule --stig-viewer viewer.xml U_RHEL_7_V3R1_STIG_SCAP_1-2_Benchmark.xml
Title   The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Rule    xccdf_mil.disa.stig_rule_SV-204393r505924_rule
Ident   CCE-26970-4
Ident   SV-86483
Ident   V-71859
Ident   CCI-000048
Result  fail

E: probe_textfilecontent54: An error ocured while receiving SEAP message. errno=103, Software caused connection abort.
Segmentation fault (core dumped)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

See Additional info for details

Version-Release number of selected component (if applicable):

openscap-scanner-1.2.17-13.el7_9.x86_64

How reproducible:

ALWAYS

Steps to Reproduce:
1. See above

Actual results:

Segfault

Expected results:

No segfault

Additional info:

Below is my analysis of the coredump:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Program terminated with signal 11, Segmentation fault.
#0  0x00007fc5458c8b30 in xccdf_rule_result_to_dom (result=0x560327893670, doc=doc@entry=0x560328120bd0, 
    parent=parent@entry=0x560328120cb0, version_info=version_info@entry=0x7fc545b209e0 <XCCDF_VERSION_MAP>, 
    benchmark=benchmark@entry=0x560327192330, use_stig_rule_id=use_stig_rule_id@entry=true) at result.c:1100
1100				if (strcmp(oscap_reference_get_href(ref), DISA_STIG_VIEWER_HREF[0]) == 0 ||
(gdb) bt
#0  0x00007fc5458c8b30 in xccdf_rule_result_to_dom (result=0x560327893670, doc=doc@entry=0x560328120bd0, 
    parent=parent@entry=0x560328120cb0, version_info=version_info@entry=0x7fc545b209e0 <XCCDF_VERSION_MAP>, 
    benchmark=benchmark@entry=0x560327192330, use_stig_rule_id=use_stig_rule_id@entry=true) at result.c:1100
#1  0x00007fc5458c94ce in xccdf_result_to_dom (result=result@entry=0x5603278f6e60, result_node=0x560328120cb0, 
    result_node@entry=0x0, doc=doc@entry=0x560328120bd0, parent=parent@entry=0x0, 
    use_stig_rule_id=use_stig_rule_id@entry=true) at result.c:930
#2  0x00007fc5458c9843 in xccdf_result_stig_viewer_export_source (result=result@entry=0x5603278f6e60, 
    filepath=0x5603278f6dc0 "viewer.xml") at result.c:735
#3  0x00007fc5458d0c75 in _build_xccdf_result_source (session=0x560326180900) at xccdf_session.c:1299
#4  xccdf_session_export_xccdf (session=session@entry=0x560326180900) at xccdf_session.c:1321
#5  0x0000560325843f34 in app_evaluate_xccdf (action=0x7ffe3ac73600) at oscap-xccdf.c:586
#6  0x000056032583f2c9 in oscap_module_call (action=0x7ffe3ac73600) at oscap-tool.c:261
#7  oscap_module_process (module=0x560325a4fb60 <XCCDF_EVAL>, module@entry=0x560325a4f0e0 <OSCAP_ROOT_MODULE>, 
    argc=argc@entry=10, argv=argv@entry=0x7ffe3ac738c8) at oscap-tool.c:346
#8  0x000056032583e061 in main (argc=10, argv=0x7ffe3ac738c8) at oscap.c:83
(gdb) p *ref
$1 = {title = 0x560327239770 "DPMS Target Red Hat Enterprise Linux 7", creator = 0x0, 
  subject = 0x560327239860 "Red Hat Enterprise Linux 7", description = 0x0, publisher = 0x5603272397c0 "DISA", 
  contributor = 0x0, date = 0x0, type = 0x560327239810 "DPMS Target", format = 0x0, 
  identifier = 0x5603272377d0 "2899", source = 0x0, language = 0x0, relation = 0x0, coverage = 0x0, rights = 0x0, 
  is_dublincore = true, href = 0x0}
(gdb) p use_stig_rule_id 
$2 = true
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

We enter the code on line 1100 because "use_stig_rule_id" is set to True, due to calling "xccdf_result_stig_viewer_export_source()" function:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
 727 struct oscap_source *xccdf_result_stig_viewer_export_source(struct xccdf_result *result, const char *filepath)
 728 {
 729         xmlDocPtr doc = xmlNewDoc(BAD_CAST "1.0");
 730         if (doc == NULL) {
 731                 oscap_setxmlerr(xmlGetLastError());
 732                 return NULL;
 733         }
 734 
 735         xccdf_result_to_dom(result, NULL, doc, NULL, true);        <<<<<< HERE with "true" as last parameter
 736         return oscap_source_new_from_xmlDoc(doc, filepath);
 737 }
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This happens because "href" is NULL, which results in having strcmp() function compare NULL pointer against a value, which segfaults:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
1084 xmlNode *xccdf_rule_result_to_dom(struct xccdf_rule_result *result, xmlDoc *doc, xmlNode *parent, const struct x     ccdf_version_info* version_info, struct xccdf_benchmark *benchmark, bool use_stig_rule_id)
1085 {
1086         const char *idref = xccdf_rule_result_get_idref(result);
1087         if (use_stig_rule_id) {
 :
1098                 while (oscap_reference_iterator_has_more(references)) {
1099                         struct oscap_reference *ref = oscap_reference_iterator_next(references);
1100                         if (strcmp(oscap_reference_get_href(ref), DISA_STIG_VIEWER_HREF[0]) == 0 ||
1101                             strcmp(oscap_reference_get_href(ref), DISA_STIG_VIEWER_HREF[1]) == 0) {
1102                                 stig_rule_id = oscap_reference_get_title(ref);
1103                                 break;
1104                         }
1105                 }
 :
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Above, on line 1100, we have a call to function "oscap_reference_get_href(ref)" which basically retrieves the field "href" from "ref" pointer.
This "href" field is NULL:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
(gdb) p *ref
$1 = {title = 0x560327239770 "DPMS Target Red Hat Enterprise Linux 7", creator = 0x0, 
  subject = 0x560327239860 "Red Hat Enterprise Linux 7", description = 0x0, publisher = 0x5603272397c0 "DISA", 
  contributor = 0x0, date = 0x0, type = 0x560327239810 "DPMS Target", format = 0x0, 
  identifier = 0x5603272377d0 "2899", source = 0x0, language = 0x0, relation = 0x0, coverage = 0x0, rights = 0x0, 
  is_dublincore = true, href = 0x0}
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

We can see that the block above is something related to "DPMS Target Red Hat Enterprise Linux 7" and ID "2899".
The corresponding XML block is found in the XML from the website, (but not found in Red Hat's scap-security-guide XML files):

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[...]
      <xccdf:Group id="xccdf_mil.disa.stig_group_V-204393">^M
        <xccdf:title>SRG-OS-000023-GPOS-00006</xccdf:title>^M
        <xccdf:description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</xccdf:description>^M
        <xccdf:Rule id="xccdf_mil.disa.stig_rule_SV-204393r505924_rule" weight="10.0" severity="medium">^M
          <xccdf:version update="http://iase.disa.mil/stigs">RHEL-07-010030</xccdf:version>^M
          <xccdf:title>The Red Hat Enterprise Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.</xccdf:title>^M
[...]
          <xccdf:reference>^M
            <dc:title>DPMS Target Red Hat Enterprise Linux 7</dc:title>^M
            <dc:publisher>DISA</dc:publisher>^M
            <dc:type>DPMS Target</dc:type>^M
            <dc:subject>Red Hat Enterprise Linux 7</dc:subject>^M
            <dc:identifier>2899</dc:identifier>^M
          </xccdf:reference>^M
          <xccdf:ident system="http://cce.mitre.org">CCE-26970-4</xccdf:ident>^M
          <xccdf:ident system="http://cyber.mil/legacy">SV-86483</xccdf:ident>^M
          <xccdf:ident system="http://cyber.mil/legacy">V-71859</xccdf:ident>^M
          <xccdf:ident system="http://cyber.mil/cci">CCI-000048</xccdf:ident>^M
          <xccdf:fixtext fixref="F-4517r88372_fix">Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.^M
[...]
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This block appears multiple times in the file.

It's possible that the newer XML file is not compatible with the scanner somehow, but anyway this shouldn't make oscap die.