flamingo-stack · flamingo · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026 · Aug 24, 2026
diff --git a/osquery/core/plugins/logger.h b/osquery/core/plugins/logger.h
@@ -219,7 +219,7 @@ class LoggerPlugin : public Plugin {
 
     if (error_count != 0) {
       return Status::failure("logEventBatch has failed to log " +
-                             std::to_string(error_count) + "events");
+                             std::to_string(error_count) + " events");
     }
 
     return Status::success();
@@ -252,3 +252,4 @@ class LoggerPlugin : public Plugin {
 };
 
 } // namespace osquery
+
diff --git a/osquery/events/darwin/es_utils.cpp b/osquery/events/darwin/es_utils.cpp
@@ -126,7 +126,7 @@ std::string getCDHash(const es_process_t* p) {
          << static_cast<unsigned int>(i);
   }
   auto s = hash.str();
-  return s.find_first_not_of(s.front()) == std::string::npos ? "" : s;
+  return s.find_first_not_of('0') == std::string::npos ? "" : s;
 }
 
 void getProcessProperties(const es_process_t* p,
@@ -146,7 +146,7 @@ void getProcessProperties(const es_process_t* p,
   ec->cwd = getCwdPathFromPid(ec->pid);
 
   ec->uid = audit_token_to_ruid(audit_token);
-  ec->euid = audit_token_to_egid(audit_token);
+  ec->euid = audit_token_to_euid(audit_token);
   ec->gid = audit_token_to_rgid(audit_token);
   ec->egid = audit_token_to_egid(audit_token);
 
@@ -171,3 +171,4 @@ void appendQuotedString(std::ostream& out, std::string s, char delim) {
 }
 
 } // namespace osquery
+
diff --git a/osquery/events/darwin/fsevents.cpp b/osquery/events/darwin/fsevents.cpp
@@ -55,7 +55,7 @@ REGISTER(FSEventsEventPublisher, "event_publisher", "fsevents");
 void FSEventsSubscriptionContext::requireAction(const std::string& action) {
   for (const auto& bit : kMaskActions) {
     if (action == bit.second) {
-      mask = mask & bit.first;
+      mask = mask | bit.first;
     }
   }
 }
@@ -380,3 +380,4 @@ bool FSEventsEventPublisher::isStreamRunning() const {
   return CFRunLoopIsWaiting(run_loop_);
 }
 }
+
diff --git a/osquery/events/darwin/scnetwork.cpp b/osquery/events/darwin/scnetwork.cpp
@@ -34,6 +34,7 @@ void SCNetworkEventPublisher::Callback(const SCNetworkReachabilityRef target,
   auto ec = createEventContext();
   ec->subscription = *(SCNetworkSubscriptionContextRef*)info;
   ec->flags = flags;
+  EventFactory::fire<SCNetworkEventPublisher>(ec);
 }
 
 bool SCNetworkEventPublisher::shouldFire(
@@ -116,14 +117,14 @@ void SCNetworkEventPublisher::configure() {
       if (sc->type == ADDRESS_TARGET) {
         auto existing_address = std::find(
             target_addresses_.begin(), target_addresses_.end(), sc->target);
-        if (existing_address != target_addresses_.end()) {
+        if (existing_address == target_addresses_.end()) {
           // Add the address target.
           addAddress(sc);
         }
       } else {
         auto existing_hostname =
             std::find(target_names_.begin(), target_names_.end(), sc->target);
-        if (existing_hostname != target_names_.end()) {
+        if (existing_hostname == target_names_.end()) {
           // Add the hostname target.
           addHostname(sc);
         }
@@ -183,3 +184,4 @@ Status SCNetworkEventPublisher::run() {
   return Status::success();
 }
 };
+
diff --git a/osquery/events/linux/bpf/filesystem.cpp b/osquery/events/linux/bpf/filesystem.cpp
@@ -125,16 +125,16 @@ bool Filesystem::enumFiles(int dirfd, EnumFilesCallback callback) const {
       continue;
     }
 
-    bool directory;
+    bool is_directory;
     if (entry->d_type == DT_DIR) {
-      directory = true;
+      is_directory = true;
     } else if (entry->d_type == DT_LNK || entry->d_type == DT_REG) {
-      directory = false;
+      is_directory = false;
     } else {
       continue;
     }
 
-    callback(string_fd, directory);
+    callback(string_fd, is_directory);
   }
 
   return true;
@@ -171,3 +171,4 @@ Status IFilesystem::create(Ref& obj) {
 }
 
 } // namespace osquery
+
diff --git a/osquery/events/tests/events_tests.cpp b/osquery/events/tests/events_tests.cpp
@@ -375,7 +375,7 @@ class FakeEventSubscriber : public EventSubscriber<FakeEventPublisher> {
 
   explicit FakeEventSubscriber(bool skip_name) {
     if (!skip_name) {
-      FakeEventSubscriber();
+      setName("fake_events");
     }
   }
 

diff --git a/osquery/events/tests/linux/bpf/utils.cpp b/osquery/events/tests/linux/bpf/utils.cpp
@@ -168,8 +168,8 @@ bool validateSocketDescriptor(const ProcessContext& process_context,
   const auto& socket_info =
       std::get<ProcessContext::FileDescriptor::SocketData>(fd_info.data);
 
-  if (!socket_info.opt_domain.has_value() || socket_info.opt_type.has_value() ||
-      socket_info.opt_protocol.has_value()) {
+  if (!socket_info.opt_domain.has_value() || !socket_info.opt_type.has_value() ||
+      !socket_info.opt_protocol.has_value()) {
     return false;
   }
 
@@ -232,3 +232,4 @@ bool validateSocketDescriptor(const ProcessContextMap& process_context_map,
 }
 
 } // namespace osquery
+
diff --git a/osquery/events/windows/etw/etw_provider_config.cpp b/osquery/events/windows/etw/etw_provider_config.cpp
@@ -26,8 +26,8 @@ Status EtwProviderConfig::isValid() const {
     return Status::failure("Type handlers were not provided");
   }
 
-  if (getPostProcessor() == nullptr) {
-    return Status::failure("Invalid Provider PostProcessor function");
+  if (getPreProcessor() == nullptr) {
+    return Status::failure("Invalid Provider PreProcessor function");
   }
 
   return Status::success();
@@ -166,4 +166,4 @@ void EtwProviderConfig::addEventTypeToHandle(const EtwEventType& value) {
   eventTypes_.push_back(value);
 }
 
-} // namespace osquery
+} // namespace osquery
diff --git a/osquery/events/windows/etw/etw_publisher_processes.cpp b/osquery/events/windows/etw/etw_publisher_processes.cpp
@@ -352,8 +352,13 @@ void EtwPublisherProcesses::providerPostProcessor(
         // Houskeeping of expired aggregation cache entries
         cleanOldAggregationCacheEntries();
 
+        // Houskeeping of the process image cache to avoid unbounded growth
+        cleanOldProcessImageCacheEntries();
+
         // Caching image full path
-        processImageCache_.insert({searchKey, procStartData->ImageName});
+        processImageCache_.insert(
+            {searchKey,
+             {procStartData->ImageName, std::time(nullptr)}});
       }
     }
   }
@@ -385,10 +390,31 @@ void EtwPublisherProcesses::cleanOldAggregationCacheEntries() {
     if ((eventTimestamp.QuadPart + expiredTime10secs) <
         currentTimestamp.QuadPart) {
       // event expire and should be deleted
-      processStartAggregationCache_.erase(it);
+      it = processStartAggregationCache_.erase(it);
+    } else {
+      ++it;
     }
+  }
+}
 
-    ++it;
+void EtwPublisherProcesses::cleanOldProcessImageCacheEntries() {
+  // Entries older than this many seconds are considered stale and removed
+  // to avoid unbounded growth of processImageCache_.
+  static constexpr std::time_t expiredTimeSecs = 300;
+
+  if (processImageCache_.empty()) {
+    return;
+  }
+
+  std::time_t currentTime = std::time(nullptr);
+
+  auto it = processImageCache_.begin();
+  while (it != processImageCache_.end()) {
+    if ((it->second.second + expiredTimeSecs) < currentTime) {
+      it = processImageCache_.erase(it);
+    } else {
+      ++it;
+    }
   }
 }
 
@@ -399,7 +425,11 @@ void EtwPublisherProcesses::updateImagePath(const std::uint64_t& key1,
   std::uint64_t searchKey = getComposedKey(key1, key2);
 
   // Event specific post processing callback logic
-  imagePath = tryTake(processImageCache_, searchKey).takeOr(imagePath);
+  auto cachedEntryIt = processImageCache_.find(searchKey);
+  if (cachedEntryIt != processImageCache_.end()) {
+    imagePath = cachedEntryIt->second.first;
+    processImageCache_.erase(cachedEntryIt);
+  }
 }
 
 void EtwPublisherProcesses::updateTokenInfo(const std::uint32_t& tokenType,
@@ -479,3 +509,4 @@ std::uint64_t EtwPublisherProcesses::getComposedKey(const std::uint64_t& key1,
 }
 
 } // namespace osquery
+
diff --git a/osquery/events/windows/windowseventlogpublisher.cpp b/osquery/events/windows/windowseventlogpublisher.cpp
@@ -147,8 +147,6 @@ Status WindowsEventLogPublisher::run() {
   auto last_fired_event_time = std::chrono::steady_clock::now();
 
   while (!isEnding()) {
-    EvtSubscription::EventList event_list;
-
     for (auto& subscription : d_->subscription_list) {
       auto event_list = subscription->getEvents();
 
@@ -208,6 +206,10 @@ double WindowsEventLogPublisher::cosineSimilarity(
   std::vector<double> buffer_freqs(kCharFreqVectorLen, 0.0);
 
   auto buffer_size = buffer.size();
+  if (buffer_size == 0) {
+    return 0.0;
+  }
+
   for (unsigned char chr : buffer) {
     if (chr < kCharFreqVectorLen) {
       buffer_freqs[chr] += 1.0 / buffer_size;
@@ -249,3 +251,4 @@ bool WindowsEventLogPublisher::shouldFire(const SCRef& subscription,
   return (subscription->channel_list.count(lowercase_channel) > 0U);
 }
 } // namespace osquery
+
diff --git a/osquery/filesystem/file_compression.cpp b/osquery/filesystem/file_compression.cpp
@@ -48,8 +48,8 @@ Status compress(const boost::filesystem::path& in,
 
   size_t const buffInSize = ZSTD_CStreamInSize();
   size_t const buffOutSize = ZSTD_CStreamOutSize();
-  std::vector<void*> buffIn(buffInSize);
-  std::vector<void*> buffOut(buffOutSize);
+  std::vector<char> buffIn(buffInSize);
+  std::vector<char> buffOut(buffOutSize);
   auto read = buffInSize;
   auto toRead = buffInSize;
   size_t readSoFar = 0;
@@ -114,8 +114,8 @@ Status decompress(const boost::filesystem::path& in,
   auto inFileSize = inFile.size();
   size_t const buffInSize = ZSTD_DStreamInSize();
   size_t const buffOutSize = ZSTD_DStreamOutSize();
-  std::vector<void*> buffIn(buffInSize);
-  std::vector<void*> buffOut(buffOutSize);
+  std::vector<char> buffIn(buffInSize);
+  std::vector<char> buffOut(buffOutSize);
 
   ZSTD_DStream* const dstream = ZSTD_createDStream();
   if (dstream == NULL) {

diff --git a/osquery/profiler/windows/code_profiler.cpp b/osquery/profiler/windows/code_profiler.cpp
@@ -51,6 +51,7 @@ CodeProfiler::~CodeProfiler() {
           code_profiler_data_end.getWallTime() -
           code_profiler_data_->getWallTime());
 
-  record(names_, ".time.wall.millis", query_duration.count());
+  record(names_, "time.wall.millis", query_duration.count());
 }
 } // namespace osquery
+
diff --git a/osquery/sql/sqlite_operations.cpp b/osquery/sql/sqlite_operations.cpp
@@ -56,13 +56,15 @@ static void executeCarve(sqlite3_context* ctx) {
   if (!FLAGS_carver_disable_function) {
     std::string new_carve_guid;
     carvePaths(kFunctionCarvePaths, createCarveGuid(), new_carve_guid);
+    std::string message = std::string("Carve Started: " + new_carve_guid);
     sqlite3_result_text(ctx,
-                        std::string("Carve Started: " + new_carve_guid).c_str(),
-                        13,
+                        message.c_str(),
+                        static_cast<int>(message.size()),
                         SQLITE_TRANSIENT);
   } else {
+    std::string message = "Carve Failed: function disabled";
     sqlite3_result_text(
-        ctx, "Carve Failed: function disabled", 13, SQLITE_TRANSIENT);
+        ctx, message.c_str(), static_cast<int>(message.size()), SQLITE_TRANSIENT);
   }
   kFunctionCarvePaths.clear();
 }
@@ -97,3 +99,4 @@ void registerOperationExtensions(sqlite3* db) {
       db, "sleep", 1, SQLITE_UTF8, nullptr, sqlSleep, nullptr, nullptr);
 }
 } // namespace osquery
+
diff --git a/osquery/system/usersgroups/windows/users_groups_cache.cpp b/osquery/system/usersgroups/windows/users_groups_cache.cpp
@@ -111,6 +111,7 @@ std::vector<User> UsersCache::getAllUsers() const {
 }
 
 void GroupsCache::initializeCache(std::vector<Group> initial_groups) {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
   cached_groups_ = std::move(initial_groups);
 
   if (cached_groups_.size() > 0) {

diff --git a/osquery/tables/applications/chrome/utils.cpp b/osquery/tables/applications/chrome/utils.cpp
@@ -104,7 +104,7 @@ const std::unordered_map<ChromeBrowserType, std::string>
         {ChromeBrowserType::Yandex, "yandex"},
         {ChromeBrowserType::Opera, "opera"},
         {ChromeBrowserType::Edge, "edge"},
-        {ChromeBrowserType::Edge, "edge_beta"},
+        {ChromeBrowserType::EdgeBeta, "edge_beta"},
         {ChromeBrowserType::Vivaldi, "vivaldi"},
         {ChromeBrowserType::Arc, "arc"},
 };
@@ -1264,3 +1264,4 @@ ExpectedExtensionKey computeExtensionIdentifier(
 } // namespace tables
 
 } // namespace osquery
+
diff --git a/osquery/tables/events/darwin/openbsm_events.cpp b/osquery/tables/events/darwin/openbsm_events.cpp
@@ -151,7 +151,7 @@ Status OpenBSMProcEvSubscriber::handleExec(const OpenBSMEventContextRef& ec) {
       r["egid"] = INTEGER(tok.tt.subj64.egid);
       r["uid"] = INTEGER(tok.tt.subj64.ruid);
       r["gid"] = INTEGER(tok.tt.subj64.rgid);
-      pid = tok.tt.subj32.pid;
+      pid = tok.tt.subj64.pid;
       break;
     case AUT_SUBJECT32_EX:
       OpenBSM_AUT_SUBJECT32_EX(r, tok);

diff --git a/osquery/tables/events/darwin/socket_events.cpp b/osquery/tables/events/darwin/socket_events.cpp
@@ -105,7 +105,7 @@ Status OpenBSMNetEvSubscriber::Callback(
           r["action"] = "connect";
         } else if (tok.tt.hdr32_ex.e_type == AUE_BIND) {
           r["action"] = "bind";
-        } else if (tok.tt.hdr32.e_type == AUE_ACCEPT) {
+        } else if (tok.tt.hdr32_ex.e_type == AUE_ACCEPT) {
           r["action"] = "accept";
         } else {
           continue;
@@ -118,7 +118,7 @@ Status OpenBSMNetEvSubscriber::Callback(
           r["action"] = "connect";
         } else if (tok.tt.hdr64_ex.e_type == AUE_BIND) {
           r["action"] = "bind";
-        } else if (tok.tt.hdr64.e_type == AUE_ACCEPT) {
+        } else if (tok.tt.hdr64_ex.e_type == AUE_ACCEPT) {
           r["action"] = "accept";
         } else {
           continue;
@@ -146,7 +146,7 @@ Status OpenBSMNetEvSubscriber::Callback(
       case AUT_SUBJECT64:
         r["auid"] = INTEGER(tok.tt.subj64.auid);
         r["pid"] = INTEGER(tok.tt.subj64.pid);
-        pid = tok.tt.subj32.pid;
+        pid = tok.tt.subj64.pid;
         break;
       case AUT_SUBJECT32_EX:
         r["auid"] = INTEGER(tok.tt.subj32_ex.auid);
@@ -234,3 +234,4 @@ Status OpenBSMNetEvSubscriber::Callback(
 }
 
 } // namespace osquery
+
diff --git a/osquery/tables/networking/curl_certificate.cpp b/osquery/tables/networking/curl_certificate.cpp
@@ -302,7 +302,7 @@ Status getTLSCertificate(const std::string& hostname,
   std::string port = "443";
   auto connect_hostname = hostname;
   auto delim = hostname.find(":");
-  if (delim + 1 == hostname.length()) {
+  if (delim != std::string::npos && delim + 1 == hostname.length()) {
     // if no port specified use default port
     connect_hostname = hostname.substr(0, delim);
   } else if (delim != std::string::npos) {
@@ -459,3 +459,4 @@ QueryData genTLSCertificate(QueryContext& context) {
 }
 } // namespace tables
 } // namespace osquery
+
diff --git a/osquery/tables/networking/darwin/routes.cpp b/osquery/tables/networking/darwin/routes.cpp
@@ -119,7 +119,7 @@ Status genArp(const struct rt_msghdr *route,
   // The cache will always know the address.
   r["address"] = ipAsString(addr_map[RTAX_DST]);
 
-  auto sdl = (struct sockaddr_dl *)addr_map[RTA_DST];
+  auto sdl = (struct sockaddr_dl *)addr_map[RTAX_DST];
   if (sdl->sdl_alen > 0) {
     r["mac"] = macAsString(LLADDR(sdl));
   } else {
@@ -220,3 +220,4 @@ QueryData genRoutes(QueryContext &context) {
 }
 }
 }
+