From e50e0902d0c50dc93998a9247e95d3510f6df9fc Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:04 +0000 Subject: [PATCH 01/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/database/database.cpp | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/osquery/database/database.cpp b/osquery/database/database.cpp index 0d48b81c59a..a812e62f7a0 100644 --- a/osquery/database/database.cpp +++ b/osquery/database/database.cpp @@ -300,7 +300,7 @@ Status getDatabaseValue(const std::string& domain, ReadLock lock(kDatabaseReset); if (!kDBInitialized) { - throw std::runtime_error("Cannot get database value: " + key); + return Status::failure("Cannot get database value: " + key); } else { auto plugin = getDatabasePlugin(); return plugin->get(domain, key, value); @@ -313,7 +313,11 @@ Status getDatabaseValue(const std::string& domain, std::string result; auto s = getDatabaseValue(domain, key, result); if (s.ok()) { - value = std::stoi(result); + auto ret = tryTo(result); + if (ret.isError()) { + return Status::failure("Invalid integer value for key: " + key); + } + value = ret.get(); } return s; } @@ -342,7 +346,7 @@ Status setDatabaseBatch(const std::string& domain, ReadLock lock(kDatabaseReset); if (!kDBInitialized) { - throw std::runtime_error("Cannot set database values"); + return Status::failure("Cannot set database values"); } auto plugin = getDatabasePlugin(); @@ -370,7 +374,7 @@ Status deleteDatabaseValue(const std::string& domain, const std::string& key) { ReadLock lock(kDatabaseReset); if (!kDBInitialized) { - throw std::runtime_error("Cannot delete database value: " + key); + return Status::failure("Cannot delete database value: " + key); } else { auto plugin = getDatabasePlugin(); return plugin->remove(domain, key); @@ -396,8 +400,8 @@ Status deleteDatabaseRange(const std::string& domain, ReadLock lock(kDatabaseReset); if (!kDBInitialized) { - throw std::runtime_error("Cannot delete database values: " + low + " - " + - high); + return Status::failure("Cannot delete database values: " + low + " - " + + high); } else { auto plugin = getDatabasePlugin(); return plugin->removeRange(domain, low, high); @@ -439,7 +443,7 @@ Status scanDatabaseKeys(const std::string& domain, ReadLock lock(kDatabaseReset); if (!kDBInitialized) { - throw std::runtime_error("Cannot scan database values: " + prefix); + return Status::failure("Cannot scan database values: " + prefix); } else { auto plugin = getDatabasePlugin(); return plugin->scan(domain, keys, prefix, max); @@ -751,3 +755,4 @@ IDatabaseInterface& getOsqueryDatabase() { return osquery_database; } } // namespace osquery + From 426054e0f4238b31faaffd18c1d1d77dc9e5aa14 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:05 +0000 Subject: [PATCH 02/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- .../events/linux/bpf/systemstatetracker.cpp | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/osquery/events/linux/bpf/systemstatetracker.cpp b/osquery/events/linux/bpf/systemstatetracker.cpp index d01e8fbee5a..cd3dc010a5b 100644 --- a/osquery/events/linux/bpf/systemstatetracker.cpp +++ b/osquery/events/linux/bpf/systemstatetracker.cpp @@ -42,7 +42,8 @@ SystemStateTracker::Ref SystemStateTracker::create() { IProcessContextFactory::Ref process_context_factory; auto status = IProcessContextFactory::create(process_context_factory); if (!status) { - throw status; + LOG(ERROR) << "Failed to create the state tracker: " << status.getMessage(); + return nullptr; } return create(std::move(process_context_factory)); @@ -51,12 +52,16 @@ SystemStateTracker::Ref SystemStateTracker::create() { SystemStateTracker::Ref SystemStateTracker::create( IProcessContextFactory::Ref process_context_factory) { try { - return SystemStateTracker::Ref( + std::unique_ptr tracker( new SystemStateTracker(std::move(process_context_factory))); - } catch (const Status& status) { - LOG(ERROR) << "Failed to create the state tracker: " << status.getMessage(); - return nullptr; + auto status = tracker->restart(); + if (!status.ok()) { + LOG(ERROR) << "Failed to create the state tracker: " << status.getMessage(); + return nullptr; + } + + return SystemStateTracker::Ref(tracker.release()); } catch (const std::bad_alloc&) { return nullptr; @@ -271,11 +276,6 @@ SystemStateTracker::SystemStateTracker( : d(new PrivateData) { d->last_expiration = getUnixTime(); d->process_context_factory = std::move(process_context_factory); - - auto status = restart(); - if (!status.ok()) { - throw status; - } } ProcessContext& SystemStateTracker::getProcessContext( @@ -1357,3 +1357,4 @@ SystemStateTracker::Context SystemStateTracker::getContextCopy() const { } } // namespace osquery + From 5229c87fe4d91c8982ee6d04c2873ba304570acf Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:06 +0000 Subject: [PATCH 03/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/remote/uri.cpp | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/osquery/remote/uri.cpp b/osquery/remote/uri.cpp index 3d22a14f8c2..d52d0df9254 100644 --- a/osquery/remote/uri.cpp +++ b/osquery/remote/uri.cpp @@ -30,7 +30,16 @@ static inline void toLower(String& s) { } } +Uri::Uri() : hasAuthority_(false), port_(0) {} + Uri::Uri(const std::string& str) : hasAuthority_(false), port_(0) { + auto status = Uri::parse(str, *this); + if (!status.ok()) { + throw std::invalid_argument(status.getMessage()); + } +} + +Status Uri::parse(const std::string& str, Uri& uri) { static const std::regex uriRegex( "([a-zA-Z][a-zA-Z0-9+.-]*):" // scheme: "([^?#]*)" // authority and path @@ -40,19 +49,19 @@ Uri::Uri(const std::string& str) : hasAuthority_(false), port_(0) { std::smatch match; if (!std::regex_match(str, match, uriRegex)) { - throw std::invalid_argument("Invalid URL"); + return Status::failure("Invalid URL"); } - scheme_ = submatch(match, 1); - toLower(scheme_); + uri.scheme_ = submatch(match, 1); + toLower(uri.scheme_); std::string authorityAndPath(match[2].first, match[2].second); std::smatch authorityAndPathMatch; if (!std::regex_match( authorityAndPath, authorityAndPathMatch, authorityAndPathRegex)) { // Does not start with //, doesn't have authority - hasAuthority_ = false; - path_ = authorityAndPath; + uri.hasAuthority_ = false; + uri.path_ = authorityAndPath; } else { static const std::regex authorityRegex( "(?:([^@:]*)(?::([^@]*))?@)?" // username, password @@ -66,26 +75,28 @@ Uri::Uri(const std::string& str) : hasAuthority_(false), port_(0) { authority.second, authorityMatch, authorityRegex)) { - throw std::invalid_argument("Invalid URI authority"); + return Status::failure("Invalid URI authority"); } std::string port(authorityMatch[4].first, authorityMatch[4].second); if (!port.empty()) { int iport = std::stoi(port); if (iport < UINT16_MAX && iport >= 0) { - port_ = static_cast(iport); + uri.port_ = static_cast(iport); } } - hasAuthority_ = true; - username_ = submatch(authorityMatch, 1); - password_ = submatch(authorityMatch, 2); - host_ = submatch(authorityMatch, 3); - path_ = submatch(authorityAndPathMatch, 2); + uri.hasAuthority_ = true; + uri.username_ = submatch(authorityMatch, 1); + uri.password_ = submatch(authorityMatch, 2); + uri.host_ = submatch(authorityMatch, 3); + uri.path_ = submatch(authorityAndPathMatch, 2); } - query_ = submatch(match, 3); - fragment_ = submatch(match, 4); + uri.query_ = submatch(match, 3); + uri.fragment_ = submatch(match, 4); + + return Status::success(); } std::string Uri::authority() const { From 1f746d47d45ebbb3ddab61cd0a2988f738549147 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:07 +0000 Subject: [PATCH 04/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/carver/carver.cpp | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/osquery/carver/carver.cpp b/osquery/carver/carver.cpp index c6f751999d4..7fa599ffc17 100644 --- a/osquery/carver/carver.cpp +++ b/osquery/carver/carver.cpp @@ -334,6 +334,8 @@ Status Carver::postCarve(const boost::filesystem::path& path) { auto contUri = TLSRequestHelper::makeURI(FLAGS_carver_continue_endpoint); Request contRequest(contUri); contRequest.setOption("hostname", FLAGS_tls_hostname); + bool anyBlockFailed = false; + Status blockFailureStatus; for (size_t i = 0; i < blkCount; i++) { std::vector block(FLAGS_carver_block_size, 0); auto r = pFile.read(block.data(), FLAGS_carver_block_size); @@ -349,15 +351,23 @@ Status Carver::postCarve(const boost::filesystem::path& path) { params.add("request_id", requestId_); params.add("data", base64::encode(std::string(block.begin(), block.end()))); - // TODO: Error sending files. status = contRequest.call(params); if (!status.ok()) { VLOG(1) << "Post of carved block " << i << " failed: " << status.getMessage(); + anyBlockFailed = true; + blockFailureStatus = status; continue; } } + if (anyBlockFailed) { + updateCarveValue(carveGuid_, "status", "DATA POST FAILED"); + return Status(1, + "Failed to post one or more carved blocks: " + + blockFailureStatus.getMessage()); + } + updateCarveValue(carveGuid_, "status", kCarverStatusSuccess); return Status::success(); }; @@ -369,3 +379,4 @@ void scheduleCarves() { } } } // namespace osquery + From 49df5b18bdb66141553ea89286f3578bbb9e6ffa Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:08 +0000 Subject: [PATCH 05/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/system/windows/services.cpp | 40 ++++++++++------------ 1 file changed, 19 insertions(+), 21 deletions(-) diff --git a/osquery/tables/system/windows/services.cpp b/osquery/tables/system/windows/services.cpp index 97136804775..6fb9cd4de8d 100644 --- a/osquery/tables/system/windows/services.cpp +++ b/osquery/tables/system/windows/services.cpp @@ -92,36 +92,33 @@ static inline Status getService(const SC_HANDLE& scmHandle, return Status(GetLastError(), "Failed to query service config"); } - try { - (void)QueryServiceConfig2( - svcHandle.get(), SERVICE_CONFIG_DESCRIPTION, nullptr, 0, &cbBufSize); - err = GetLastError(); - if (ERROR_INSUFFICIENT_BUFFER == err) { - svc_descr_t lpsd(static_cast(malloc(cbBufSize)), - freePtr); - if (lpsd == nullptr) { - throw std::runtime_error("failed to malloc service description buffer"); - } + (void)QueryServiceConfig2( + svcHandle.get(), SERVICE_CONFIG_DESCRIPTION, nullptr, 0, &cbBufSize); + err = GetLastError(); + if (ERROR_INSUFFICIENT_BUFFER == err) { + svc_descr_t lpsd(static_cast(malloc(cbBufSize)), + freePtr); + if (lpsd == nullptr) { + LOG(WARNING) << svc.lpServiceName + << ": failed to malloc service description buffer"; + } else { ret = QueryServiceConfig2(svcHandle.get(), SERVICE_CONFIG_DESCRIPTION, (LPBYTE)lpsd.get(), cbBufSize, &cbBufSize); if (ret == 0) { - std::stringstream ss; - ss << "failed to query size of service description buffer, error: " - << GetLastError(); - throw std::runtime_error(ss.str()); - } - if (lpsd->lpDescription != nullptr) { + LOG(WARNING) << svc.lpServiceName + << ": failed to query size of service description " + "buffer, error: " + << GetLastError(); + } else if (lpsd->lpDescription != nullptr) { r["description"] = SQL_TEXT(wstringToString(lpsd->lpDescription)); } - } else if (ERROR_MUI_FILE_NOT_FOUND != err) { - // Bug in Windows 10 with CDPUserSvc_63718, just ignore description - throw std::runtime_error("failed to query service description"); } - } catch (const std::runtime_error& e) { - LOG(WARNING) << svc.lpServiceName << ": " << e.what(); + } else if (ERROR_MUI_FILE_NOT_FOUND != err) { + // Bug in Windows 10 with CDPUserSvc_63718, just ignore description + LOG(WARNING) << svc.lpServiceName << ": failed to query service description"; } r["name"] = SQL_TEXT(wstringToString(svc.lpServiceName)); @@ -226,3 +223,4 @@ QueryData genServices(QueryContext& context) { } } // namespace tables } // namespace osquery + From 4ee65141479e09e57f71c9dc6765db5f6956fd43 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:09 +0000 Subject: [PATCH 06/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/yara/yara.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/osquery/tables/yara/yara.cpp b/osquery/tables/yara/yara.cpp index e5f03b1330a..e1b1ea863c4 100644 --- a/osquery/tables/yara/yara.cpp +++ b/osquery/tables/yara/yara.cpp @@ -98,10 +98,9 @@ static YARAConfigParser getYaraParser(void) { return nullptr; } - YARAConfigParser yaraParser = nullptr; - try { - yaraParser = std::dynamic_pointer_cast(parser); - } catch (const std::bad_cast&) { + YARAConfigParser yaraParser = + std::dynamic_pointer_cast(parser); + if (isNull(yaraParser)) { LOG(ERROR) << "Cannot cast YARA config parser plugin"; return nullptr; } @@ -454,3 +453,4 @@ QueryData genYara(QueryContext& context) { } // namespace tables } // namespace osquery + From 12d45bb0ac4e9d09b0b7111483c9cca39d731b69 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:10 +0000 Subject: [PATCH 07/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/events/windows/evtsubscription.cpp | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/osquery/events/windows/evtsubscription.cpp b/osquery/events/windows/evtsubscription.cpp index 323f081f666..8eea0081531 100644 --- a/osquery/events/windows/evtsubscription.cpp +++ b/osquery/events/windows/evtsubscription.cpp @@ -54,14 +54,18 @@ Status EvtSubscription::create(EvtSubscription::Ref& obj, obj.reset(); try { - obj.reset(new EvtSubscription(channel)); + auto obj_ptr = std::unique_ptr(new EvtSubscription(channel)); + + auto status = obj_ptr->init(); + if (!status.ok()) { + return status; + } + + obj = std::move(obj_ptr); return Status::success(); } catch (const std::bad_alloc&) { return Status::failure("Memory allocation failure"); - - } catch (const Status& status) { - return status; } } @@ -96,7 +100,10 @@ EvtSubscription::EventList EvtSubscription::getEvents() { EvtSubscription::EvtSubscription(const std::string& channel) : d_(new PrivateData) { d_->channel = channel; - auto channel_utf16 = stringToWstring(channel); +} + +Status EvtSubscription::init() { + auto channel_utf16 = stringToWstring(d_->channel); auto subscription = EvtSubscribe(nullptr, nullptr, @@ -109,11 +116,12 @@ EvtSubscription::EvtSubscription(const std::string& channel) if (subscription == nullptr) { auto error = GetLastError(); - throw Status::failure("Failed to subscribe to the channel named " + - channel + ". Error " + std::to_string(error)); + return Status::failure("Failed to subscribe to the channel named " + + d_->channel + ". Error " + std::to_string(error)); } d_->handle = subscription; + return Status::success(); } void EvtSubscription::processEvent(EVT_HANDLE event) { From 9a84eabe13d2f3cdf13ed4513256c25aef4bc238 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:11 +0000 Subject: [PATCH 08/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/yara/yara_utils.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/osquery/tables/yara/yara_utils.h b/osquery/tables/yara/yara_utils.h index 85f423aea84..4d1b2fd05c6 100644 --- a/osquery/tables/yara/yara_utils.h +++ b/osquery/tables/yara/yara_utils.h @@ -11,6 +11,8 @@ #include +#include + #include #include #include @@ -70,6 +72,7 @@ using YaraCompilerResult = Expected; void YARACompilerCallback(int error_level, const char* file_name, int line_number, + const YR_RULE* rule, const char* message, void* user_data); @@ -82,7 +85,7 @@ YaraCompilerResult compileSingleFile(const std::string& file); YaraCompilerResult compileFromString(const std::string& buffer); Status handleRuleFiles(const std::string& category, - const pt::ptree& rule_files, + const rapidjson::Value& rule_files, std::map& rules); /** @@ -134,3 +137,4 @@ class YARAConfigParserPlugin : public ConfigParserPlugin { Status update(const std::string& source, const ParserConfig& config) override; }; } // namespace osquery + From e3b448747d7d8cb5eeaae3bbe20018c2f11f552a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:12 +0000 Subject: [PATCH 09/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/events/windows/ntfs_event_publisher.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/events/windows/ntfs_event_publisher.cpp b/osquery/events/windows/ntfs_event_publisher.cpp index 80bd2c3eaaa..ed6463ebc49 100644 --- a/osquery/events/windows/ntfs_event_publisher.cpp +++ b/osquery/events/windows/ntfs_event_publisher.cpp @@ -251,7 +251,7 @@ Status NTFSEventPublisher::getPathFromReferenceNumber( buffer.resize(required_characters); if (buffer.size() != required_characters) { ::CloseHandle(handle); - throw std::bad_alloc(); + return Status::failure("Failed to allocate buffer for path resolution"); } auto bytes_returned = static_cast( From b7bc1efee45e7252f5a8cabc8cbf7452873fb4f7 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:13 +0000 Subject: [PATCH 10/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/system/tests/posix/ssh_keys_tests.cpp | 2 -- 1 file changed, 2 deletions(-) diff --git a/osquery/tables/system/tests/posix/ssh_keys_tests.cpp b/osquery/tables/system/tests/posix/ssh_keys_tests.cpp index 1c494b94a17..92e883dcdc7 100644 --- a/osquery/tables/system/tests/posix/ssh_keys_tests.cpp +++ b/osquery/tables/system/tests/posix/ssh_keys_tests.cpp @@ -13,8 +13,6 @@ #include -#include -#include #include #include #include From 915300dc8a608ff0bcf39145a1be0f9aae9fd9ae Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:14 +0000 Subject: [PATCH 11/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/remote/transports/tls.cpp | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/osquery/remote/transports/tls.cpp b/osquery/remote/transports/tls.cpp index e10ee3ac9ac..155dc2642dc 100644 --- a/osquery/remote/transports/tls.cpp +++ b/osquery/remote/transports/tls.cpp @@ -67,6 +67,11 @@ HIDDEN_FLAG(bool, tls_allow_unsafe, false, "Allow TLS server certificate trust failures"); + +HIDDEN_FLAG(bool, + openframe_mode_allow_unsafe, + false, + "Allow disabling TLS peer verification in openframe_mode"); #endif HIDDEN_FLAG(bool, @@ -111,11 +116,13 @@ http::Client::Options TLSTransport::getOptions() { options.follow_redirects(true).timeout(16); - if (FLAGS_openframe_mode) { +#ifndef NDEBUG + if (FLAGS_openframe_mode && FLAGS_openframe_mode_allow_unsafe) { options.always_verify_peer(false); return options; - } - + } +#endif + options.always_verify_peer(verify_peer_); if (server_certificate_file_.size() > 0) { if (!osquery::isReadable(server_certificate_file_).ok()) { @@ -308,3 +315,4 @@ Status TLSTransport::sendRequest(const std::string& params, bool compress) { return response_status_; } } // namespace osquery + From f800510ec5ddce74f819aba1245c00b9194d2fe7 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:15 +0000 Subject: [PATCH 12/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/system/darwin/password_policy.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/darwin/password_policy.cpp b/osquery/tables/system/darwin/password_policy.cpp index eab50cd3fc9..b0af806efd3 100644 --- a/osquery/tables/system/darwin/password_policy.cpp +++ b/osquery/tables/system/darwin/password_policy.cpp @@ -136,7 +136,12 @@ QueryData genPasswordPolicy(QueryContext& context) { CFRelease(user_policy); } } - CFRelease(records); + if (records != nullptr) { + CFRelease(records); + } + if (query != nullptr) { + CFRelease(query); + } CFRelease(uid_string); } From a6a8b37ea867f6bdb418ba5df0ed18f066727b75 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:16 +0000 Subject: [PATCH 13/13] fix(OSQUERY-002-2): 22 review findings across 13 files --- osquery/tables/system/windows/programs.cpp | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/osquery/tables/system/windows/programs.cpp b/osquery/tables/system/windows/programs.cpp index d25cc2bc8fe..5ef5f25f416 100644 --- a/osquery/tables/system/windows/programs.cpp +++ b/osquery/tables/system/windows/programs.cpp @@ -68,17 +68,16 @@ std::string findSelfClosingTag(const std::string& xml, // Convert a Unix timestamp to a date in YYYYMMDD format std::string formatTimestampToDate(time_t timestamp) { - try { - // Convert the timestamp to a tm structure - std::tm* timeInfo = std::gmtime(×tamp); - - // Format the date as YYYYMMDD - std::ostringstream oss; - oss << std::put_time(timeInfo, "%Y%m%d"); - return oss.str(); - } catch (...) { + // Convert the timestamp to a tm structure + std::tm* timeInfo = std::gmtime(×tamp); + if (timeInfo == nullptr) { return ""; } + + // Format the date as YYYYMMDD + std::ostringstream oss; + oss << std::put_time(timeInfo, "%Y%m%d"); + return oss.str(); } std::string packageFamilyNameFromPackageFullName( @@ -457,3 +456,4 @@ QueryData genPrograms(QueryContext& context) { } } // namespace tables } // namespace osquery +