{"ref":"refs/heads/maint-1.3","before":"c1c0d758f977a6a30eb15cf662669e5c54e21b26","after":"888c69fcdec8b1aa857e92b2d19eb5ed7ccd46e1","repository":{"id":19279199,"node_id":"MDEwOlJlcG9zaXRvcnkxOTI3OTE5OQ==","name":"openscap","full_name":"OpenSCAP/openscap","private":false,"owner":{"name":"OpenSCAP","email":null,"login":"OpenSCAP","id":7439934,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc0Mzk5MzQ=","avatar_url":"https://avatars.githubusercontent.com/u/7439934?v=4","gravatar_id":"","url":"https://api.github.com/users/OpenSCAP","html_url":"https://github.com/OpenSCAP","followers_url":"https://api.github.com/users/OpenSCAP/followers","following_url":"https://api.github.com/users/OpenSCAP/following{/other_user}","gists_url":"https://api.github.com/users/OpenSCAP/gists{/gist_id}","starred_url":"https://api.github.com/users/OpenSCAP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OpenSCAP/subscriptions","organizations_url":"https://api.github.com/users/OpenSCAP/orgs","repos_url":"https://api.github.com/users/OpenSCAP/repos","events_url":"https://api.github.com/users/OpenSCAP/events{/privacy}","received_events_url":"https://api.github.com/users/OpenSCAP/received_events","type":"Organization","user_view_type":"public","site_admin":false},"html_url":"https://github.com/OpenSCAP/openscap","description":"NIST Certified SCAP 1.2 toolkit","fork":false,"url":"https://api.github.com/repos/OpenSCAP/openscap","forks_url":"https://api.github.com/repos/OpenSCAP/openscap/forks","keys_url":"https://api.github.com/repos/OpenSCAP/openscap/keys{/key_id}","collaborators_url":"https://api.github.com/repos/OpenSCAP/openscap/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/OpenSCAP/openscap/teams","hooks_url":"https://api.github.com/repos/OpenSCAP/openscap/hooks","issue_events_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/events{/number}","events_url":"https://api.github.com/repos/OpenSCAP/openscap/events","assignees_url":"https://api.github.com/repos/OpenSCAP/openscap/assignees{/user}","branches_url":"https://api.github.com/repos/OpenSCAP/openscap/branches{/branch}","tags_url":"https://api.github.com/repos/OpenSCAP/openscap/tags","blobs_url":"https://api.github.com/repos/OpenSCAP/openscap/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/OpenSCAP/openscap/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/OpenSCAP/openscap/git/refs{/sha}","trees_url":"https://api.github.com/repos/OpenSCAP/openscap/git/trees{/sha}","statuses_url":"https://api.github.com/repos/OpenSCAP/openscap/statuses/{sha}","languages_url":"https://api.github.com/repos/OpenSCAP/openscap/languages","stargazers_url":"https://api.github.com/repos/OpenSCAP/openscap/stargazers","contributors_url":"https://api.github.com/repos/OpenSCAP/openscap/contributors","subscribers_url":"https://api.github.com/repos/OpenSCAP/openscap/subscribers","subscription_url":"https://api.github.com/repos/OpenSCAP/openscap/subscription","commits_url":"https://api.github.com/repos/OpenSCAP/openscap/commits{/sha}","git_commits_url":"https://api.github.com/repos/OpenSCAP/openscap/git/commits{/sha}","comments_url":"https://api.github.com/repos/OpenSCAP/openscap/comments{/number}","issue_comment_url":"https://api.github.com/repos/OpenSCAP/openscap/issues/comments{/number}","contents_url":"https://api.github.com/repos/OpenSCAP/openscap/contents/{+path}","compare_url":"https://api.github.com/repos/OpenSCAP/openscap/compare/{base}...{head}","merges_url":"https://api.github.com/repos/OpenSCAP/openscap/merges","archive_url":"https://api.github.com/repos/OpenSCAP/openscap/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/OpenSCAP/openscap/downloads","issues_url":"https://api.github.com/repos/OpenSCAP/openscap/issues{/number}","pulls_url":"https://api.github.com/repos/OpenSCAP/openscap/pulls{/number}","milestones_url":"https://api.github.com/repos/OpenSCAP/openscap/milestones{/number}","notifications_url":"https://api.github.com/repos/OpenSCAP/openscap/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/OpenSCAP/openscap/labels{/name}","releases_url":"https://api.github.com/repos/OpenSCAP/openscap/releases{/id}","deployments_url":"https://api.github.com/repos/OpenSCAP/openscap/deployments","created_at":1398781414,"updated_at":"2026-09-28T13:21:54Z","pushed_at":1791213524,"git_url":"git://github.com/OpenSCAP/openscap.git","ssh_url":"git@github.com:OpenSCAP/openscap.git","clone_url":"https://github.com/OpenSCAP/openscap.git","svn_url":"https://github.com/OpenSCAP/openscap","homepage":"https://www.open-scap.org/tools/openscap-base","size":31619,"stargazers_count":1824,"watchers_count":1824,"language":"XSLT","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"has_discussions":true,"forks_count":452,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":74,"license":{"key":"lgpl-2.1","name":"GNU Lesser General Public License v2.1","spdx_id":"LGPL-2.1","url":"https://api.github.com/licenses/lgpl-2.1","node_id":"MDc6TGljZW5zZTEx"},"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"has_pull_requests":true,"pull_request_creation_policy":"all","topics":["compliance","cpe","data-stream","openscap","oval","scanning","scap","xccdf"],"visibility":"public","forks":452,"open_issues":74,"watchers":1824,"default_branch":"main","stargazers":1824,"master_branch":"main","organization":"OpenSCAP","custom_properties":{}},"pusher":{"name":"jan-cerny","email":"jcerny@redhat.com"},"forced":false,"organization":{"login":"OpenSCAP","id":7439934,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc0Mzk5MzQ=","url":"https://api.github.com/orgs/OpenSCAP","repos_url":"https://api.github.com/orgs/OpenSCAP/repos","events_url":"https://api.github.com/orgs/OpenSCAP/events","hooks_url":"https://api.github.com/orgs/OpenSCAP/hooks","issues_url":"https://api.github.com/orgs/OpenSCAP/issues","members_url":"https://api.github.com/orgs/OpenSCAP/members{/member}","public_members_url":"https://api.github.com/orgs/OpenSCAP/public_members{/member}","avatar_url":"https://avatars.githubusercontent.com/u/7439934?v=4","description":"Open Source Security Compliance Solution"},"sender":{"login":"jan-cerny","id":9050916,"node_id":"MDQ6VXNlcjkwNTA5MTY=","avatar_url":"https://avatars.githubusercontent.com/u/9050916?v=4","gravatar_id":"","url":"https://api.github.com/users/jan-cerny","html_url":"https://github.com/jan-cerny","followers_url":"https://api.github.com/users/jan-cerny/followers","following_url":"https://api.github.com/users/jan-cerny/following{/other_user}","gists_url":"https://api.github.com/users/jan-cerny/gists{/gist_id}","starred_url":"https://api.github.com/users/jan-cerny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jan-cerny/subscriptions","organizations_url":"https://api.github.com/users/jan-cerny/orgs","repos_url":"https://api.github.com/users/jan-cerny/repos","events_url":"https://api.github.com/users/jan-cerny/events{/privacy}","received_events_url":"https://api.github.com/users/jan-cerny/received_events","type":"User","user_view_type":"public","site_admin":false},"created":false,"deleted":false,"base_ref":null,"compare":"https://github.com/OpenSCAP/openscap/compare/c1c0d758f977...888c69fcdec8","commits":[{"id":"a478d54cbc899029d52a4cc0dcd53350c4b05d55","tree_id":"c2389fbe649e36f7a4b373b4dfb72e7e33ee342a","distinct":false,"message":"XCCDF/OVAL/CPE/DS: fix NULL-pointer dereferences on malformed input\n\nMissing XML attributes/namespaces/text make libxml return NULL, which was\nthen passed to strcmp/atoi/atof or dereferenced. Guard these and make the\nshared string helpers NULL-tolerant.\n\n- common/util.h: oscap_str_startswith()/oscap_str_endswith() return false on\n  a NULL string (matching oscap_strcmp/oscap_streq).\n- OVAL: guard the optional `version` attribute before atoi() in oval_state,\n  oval_definition, oval_object, oval_variable, oval_resultDefinition; guard\n  the `reported` attribute (oval_directives); guard a NULL frame from a\n  duplicate variable id (oval_varModel).\n- XCCDF: NULL-safe atof() for empty lower/upper-bound and score elements\n  (value.c, result.c); reject a NULL <TestResult> (benchmark.c); skip a\n  <platform> with no @idref before strlen() (item.c); reject a NULL profile\n  in tailoring (tailoring.c).\n- DS: NULL-safe id comparisons in sds_index / rds; reject a component with no\n  id as a hash key (ds_rds_session.c).","timestamp":"2026-10-04T16:15:23-05:00","url":"https://github.com/OpenSCAP/openscap/commit/a478d54cbc899029d52a4cc0dcd53350c4b05d55","author":{"name":"Edouard Schweisguth","email":"edouard.schweisguth@datadoghq.com","date":"2026-06-03T08:46:38Z","username":"edznux-dd"},"committer":{"name":"Matthew Burket","email":"mburket@redhat.com","date":"2026-10-04T16:15:23-05:00","username":"Mab879"},"added":[],"removed":[],"modified":["src/DS/ds_rds_session.c","src/DS/rds.c","src/DS/sds_index.c","src/OVAL/oval_definition.c","src/OVAL/oval_directives.c","src/OVAL/oval_object.c","src/OVAL/oval_state.c","src/OVAL/oval_varModel.c","src/OVAL/oval_variable.c","src/OVAL/results/oval_resultDefinition.c","src/XCCDF/benchmark.c","src/XCCDF/item.c","src/XCCDF/result.c","src/XCCDF/tailoring.c","src/XCCDF/value.c","src/common/util.h"]},{"id":"4a9723b2ed4d1df96f793b60246122bdf1794eaf","tree_id":"ddf51fea79441fa2e208bd75fd88fb8b7620c31d","distinct":false,"message":"address PR comments","timestamp":"2026-10-04T16:15:33-05:00","url":"https://github.com/OpenSCAP/openscap/commit/4a9723b2ed4d1df96f793b60246122bdf1794eaf","author":{"name":"Edouard Schweisguth","email":"edouard.schweisguth@datadoghq.com","date":"2026-06-04T08:21:45Z","username":"edznux-dd"},"committer":{"name":"Matthew Burket","email":"mburket@redhat.com","date":"2026-10-04T16:15:33-05:00","username":"Mab879"},"added":[],"removed":[],"modified":["src/DS/sds_index.c","src/XCCDF/result.c","src/XCCDF/value.c"]},{"id":"cd86903a497eca910963549513dd1667db7a87c9","tree_id":"90e83d13fcd059810bee795db35106dc7e58757e","distinct":false,"message":"Add regression test for fixed bugs/vulns","timestamp":"2026-10-04T16:15:41-05:00","url":"https://github.com/OpenSCAP/openscap/commit/cd86903a497eca910963549513dd1667db7a87c9","author":{"name":"Edouard Schweisguth","email":"edouard.schweisguth@datadoghq.com","date":"2026-06-08T10:05:52Z","username":"edznux-dd"},"committer":{"name":"Matthew Burket","email":"mburket@redhat.com","date":"2026-10-04T16:15:41-05:00","username":"Mab879"},"added":["tests/API/OVAL/unittests/test_null_ptr_regression.oval.xml","tests/API/OVAL/unittests/test_null_ptr_regression.sh","tests/API/OVAL/unittests/test_null_ptr_regression_varmodel.oval_variables.xml","tests/API/XCCDF/unittests/test_null_ptr_regression.sh","tests/API/XCCDF/unittests/test_null_ptr_xccdf_empty_testresult.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_platform_no_idref.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_tailoring_empty_profile.xml","tests/DS/test_null_ptr_rds_missing_rel_type.xml","tests/DS/test_null_ptr_regression.sh","tests/DS/test_null_ptr_sds_empty_collection.xml","tests/DS/test_null_ptr_sds_stream_no_id.xml"],"removed":[],"modified":["tests/API/OVAL/unittests/CMakeLists.txt","tests/API/XCCDF/unittests/CMakeLists.txt","tests/DS/CMakeLists.txt","tests/test_common.sh.in"]},{"id":"888c69fcdec8b1aa857e92b2d19eb5ed7ccd46e1","tree_id":"e8ccb5c062243fba81b5178f3ec3a40c1f03ee78","distinct":true,"message":"Merge pull request #2423 from Mab879/2361_maint_1_3\n\nBackport 2361","timestamp":"2026-10-05T17:18:43+02:00","url":"https://github.com/OpenSCAP/openscap/commit/888c69fcdec8b1aa857e92b2d19eb5ed7ccd46e1","author":{"name":"Jan Černý","email":"jcerny@redhat.com","date":"2026-10-05T17:18:43+02:00","username":"jan-cerny"},"committer":{"name":"GitHub","email":"noreply@github.com","date":"2026-10-05T17:18:43+02:00","username":"web-flow"},"added":["tests/API/OVAL/unittests/test_null_ptr_regression.oval.xml","tests/API/OVAL/unittests/test_null_ptr_regression.sh","tests/API/OVAL/unittests/test_null_ptr_regression_varmodel.oval_variables.xml","tests/API/XCCDF/unittests/test_null_ptr_regression.sh","tests/API/XCCDF/unittests/test_null_ptr_xccdf_empty_testresult.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_platform_no_idref.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_tailoring_empty_profile.xml","tests/DS/test_null_ptr_rds_missing_rel_type.xml","tests/DS/test_null_ptr_regression.sh","tests/DS/test_null_ptr_sds_empty_collection.xml","tests/DS/test_null_ptr_sds_stream_no_id.xml"],"removed":[],"modified":["src/DS/ds_rds_session.c","src/DS/rds.c","src/DS/sds_index.c","src/OVAL/oval_definition.c","src/OVAL/oval_directives.c","src/OVAL/oval_object.c","src/OVAL/oval_state.c","src/OVAL/oval_varModel.c","src/OVAL/oval_variable.c","src/OVAL/results/oval_resultDefinition.c","src/XCCDF/benchmark.c","src/XCCDF/item.c","src/XCCDF/result.c","src/XCCDF/tailoring.c","src/XCCDF/value.c","src/common/util.h","tests/API/OVAL/unittests/CMakeLists.txt","tests/API/XCCDF/unittests/CMakeLists.txt","tests/DS/CMakeLists.txt","tests/test_common.sh.in"]}],"head_commit":{"id":"888c69fcdec8b1aa857e92b2d19eb5ed7ccd46e1","tree_id":"e8ccb5c062243fba81b5178f3ec3a40c1f03ee78","distinct":true,"message":"Merge pull request #2423 from Mab879/2361_maint_1_3\n\nBackport 2361","timestamp":"2026-10-05T17:18:43+02:00","url":"https://github.com/OpenSCAP/openscap/commit/888c69fcdec8b1aa857e92b2d19eb5ed7ccd46e1","author":{"name":"Jan Černý","email":"jcerny@redhat.com","date":"2026-10-05T17:18:43+02:00","username":"jan-cerny"},"committer":{"name":"GitHub","email":"noreply@github.com","date":"2026-10-05T17:18:43+02:00","username":"web-flow"},"added":["tests/API/OVAL/unittests/test_null_ptr_regression.oval.xml","tests/API/OVAL/unittests/test_null_ptr_regression.sh","tests/API/OVAL/unittests/test_null_ptr_regression_varmodel.oval_variables.xml","tests/API/XCCDF/unittests/test_null_ptr_regression.sh","tests/API/XCCDF/unittests/test_null_ptr_xccdf_empty_testresult.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_platform_no_idref.xml","tests/API/XCCDF/unittests/test_null_ptr_xccdf_tailoring_empty_profile.xml","tests/DS/test_null_ptr_rds_missing_rel_type.xml","tests/DS/test_null_ptr_regression.sh","tests/DS/test_null_ptr_sds_empty_collection.xml","tests/DS/test_null_ptr_sds_stream_no_id.xml"],"removed":[],"modified":["src/DS/ds_rds_session.c","src/DS/rds.c","src/DS/sds_index.c","src/OVAL/oval_definition.c","src/OVAL/oval_directives.c","src/OVAL/oval_object.c","src/OVAL/oval_state.c","src/OVAL/oval_varModel.c","src/OVAL/oval_variable.c","src/OVAL/results/oval_resultDefinition.c","src/XCCDF/benchmark.c","src/XCCDF/item.c","src/XCCDF/result.c","src/XCCDF/tailoring.c","src/XCCDF/value.c","src/common/util.h","tests/API/OVAL/unittests/CMakeLists.txt","tests/API/XCCDF/unittests/CMakeLists.txt","tests/DS/CMakeLists.txt","tests/test_common.sh.in"]}}