Skip to content

Commit d8c0cd1

Browse files
author
mtirum011
committed
RDK-60307 [RRD] RDK Coverity Defect Resolution for Device Management
1 parent c613c0b commit d8c0cd1

4 files changed

Lines changed: 95 additions & 18 deletions

File tree

src/rrdEventProcess.c

Lines changed: 44 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -114,11 +114,11 @@ void processIssueTypeEvent(data_buf *rbuf)
114114
}
115115

116116
}
117-
if( cmdMap)
118-
{
117+
if( cmdMap)
118+
{
119119
free(cmdMap);
120-
cmdMap = NULL;
121-
}
120+
cmdMap = NULL;
121+
}
122122
}
123123
}
124124

@@ -155,6 +155,7 @@ static void processIssueType(data_buf *rbuf)
155155
if (dynamicprofiledata == NULL)
156156
{
157157
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Dynamic Profie Info not found, Download RDM package... \n", __FUNCTION__, __LINE__);
158+
free(pIssueNode); // free issue node struct when dynamic profile not found
158159
}
159160
else
160161
{
@@ -164,6 +165,17 @@ static void processIssueType(data_buf *rbuf)
164165
if (staticprofiledata == NULL)
165166
{
166167
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Static Command Info not found for IssueType!!! \n", __FUNCTION__, __LINE__);
168+
// Free dynamicprofiledata since we can't proceed
169+
if (dynamicprofiledata->rfcvalue != NULL)
170+
{
171+
free(dynamicprofiledata->rfcvalue);
172+
}
173+
if (dynamicprofiledata->command != NULL)
174+
{
175+
free(dynamicprofiledata->command);
176+
}
177+
free(dynamicprofiledata);
178+
free(pIssueNode); // free issue node struct
167179
}
168180
else
169181
{
@@ -173,35 +185,54 @@ static void processIssueType(data_buf *rbuf)
173185
size_t dynamicstrlen = strlen(dynamicprofiledata->command);
174186
if (staticstrlen > 0 && staticprofiledata->command[staticstrlen - 1] == '"') {
175187
staticprofiledata->command[staticstrlen - 1] = '\0';
188+
staticstrlen--; // Update length after removing trailing quote
176189
}
177190
if (dynamicprofiledata->command[0] == '"') {
178191
dynamicprofiledata->command[0] = COMMAND_DELIM;
179192
}
180193
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Static Profile Commands: %s, Dynamic Profile Commands: %s\n", __FUNCTION__, __LINE__, staticprofiledata->command, dynamicprofiledata->command);
181194

182-
size_t appendstrlen = ((staticstrlen - 1) + dynamicstrlen + 1);
195+
size_t appendstrlen = (staticstrlen + dynamicstrlen + 1);
183196
char *appendcommandstr = (char *)realloc(staticprofiledata->command, appendstrlen);
184197
if (appendcommandstr == NULL) {
185-
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Memory Allocation Failed... \n", __FUNCTION__, __LINE__);
198+
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: Memory Allocation Failed... \n", __FUNCTION__, __LINE__);
199+
free(pIssueNode); // free issue node struct on realloc failure
200+
}
201+
else
202+
{
203+
strcat(appendcommandstr, dynamicprofiledata->command);
204+
staticprofiledata->command = appendcommandstr;
205+
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Updated command after append from dynamic and static profile: %s \n", __FUNCTION__, __LINE__, staticprofiledata->command);
206+
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Executing Commands in Runtime Service... \n",__FUNCTION__,__LINE__);
207+
checkIssueNodeInfo(pIssueNode, NULL, rbuf, false, staticprofiledata);
208+
// pIssueNode is NOT freed here - checkIssueNodeInfo frees Node and subNode members only
209+
free(pIssueNode); // free issue node struct after command execution
186210
}
187-
strcat(appendcommandstr, dynamicprofiledata->command);
188-
staticprofiledata->command = appendcommandstr;
189-
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Updated command after append from dynamic and static profile: %s \n", __FUNCTION__, __LINE__, staticprofiledata->command);
190-
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Executing Commands in Runtime Service... \n",__FUNCTION__,__LINE__);
191-
checkIssueNodeInfo(pIssueNode, NULL, rbuf, false, staticprofiledata);
211+
// Free dynamicprofiledata after use
212+
if (dynamicprofiledata->rfcvalue != NULL)
213+
{
214+
free(dynamicprofiledata->rfcvalue);
215+
}
216+
if (dynamicprofiledata->command != NULL)
217+
{
218+
free(dynamicprofiledata->command);
219+
}
220+
free(dynamicprofiledata);
192221
}
193222
}
194223
}
195224
else if (rbuf->inDynamic)
196225
{
197226
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Checking if Issue marked inDynamic... \n", __FUNCTION__, __LINE__);
198227
processIssueTypeInDynamicProfile(rbuf, pIssueNode);
228+
free(pIssueNode); // free issue node struct
199229
}
200230
else
201231
{
202232
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Issue not marked as inDynamic... \n", __FUNCTION__, __LINE__);
203233
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Checking Issue from Static... \n", __FUNCTION__, __LINE__);
204234
processIssueTypeInStaticProfile(rbuf, pIssueNode);
235+
free(pIssueNode); // free issue node struct
205236
}
206237
//CID-336989: Resource leak
207238
}
@@ -303,6 +334,8 @@ static void processIssueTypeInStaticProfile(data_buf *rbuf, issueNodeData *pIssu
303334
{ // Static Profile JSON Parsing or Read Fail
304335
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: Static Profile Parse/Read failed... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);
305336
processIssueTypeInInstalledPackage(rbuf, pIssueNode);
337+
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: ...Exiting...\n", __FUNCTION__, __LINE__);
338+
return;
306339
}
307340
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Static Profile Parse And Read Success... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);
308341
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Check if Issue in Parsed Static JSON... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);

src/rrdInterface.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,9 +335,11 @@ void _remoteDebuggerEventHandler(rbusHandle_t handle, rbusEvent_t const* event,
335335
}
336336
strncpy(dataMsg, rbusValue_GetString(value, NULL), len-1);
337337
dataMsg[len-1]='\0';
338+
338339
if (dataMsg[0] == '\0' || len <= 0 )
339340
{
340341
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Message Received is empty, Exit Processing!!! \n", __FUNCTION__, __LINE__);
342+
free(dataMsg);
341343
}
342344
else
343345
{

src/rrdJsonParser.c

Lines changed: 42 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,22 @@ char * readJsonFile(char *jsonfile)
9696
}
9797
fseek(fp, 0, SEEK_SET);
9898
jsonfile_content = (char *) malloc(sizeof(char) * (ch_count + 1));
99-
fread(jsonfile_content, 1, ch_count,fp);
99+
if (jsonfile_content == NULL)
100+
{
101+
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Memory allocation failed for json file %s \n",__FUNCTION__,__LINE__,jsonfile);
102+
fclose(fp);
103+
return NULL;
104+
}
105+
106+
size_t bytes_read = fread(jsonfile_content, 1, ch_count, fp);
107+
if (bytes_read != (size_t)ch_count)
108+
{
109+
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Failed to read json file %s. Expected %d bytes, read %zu bytes \n",__FUNCTION__,__LINE__,jsonfile,ch_count,bytes_read);
110+
free(jsonfile_content);
111+
fclose(fp);
112+
return NULL;
113+
}
114+
100115
jsonfile_content[ch_count] ='\0';
101116
fclose(fp);
102117

@@ -312,6 +327,10 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
312327
tmpCommand = cJSON_Print(elem);
313328
if(tmpCommand)
314329
{
330+
if(issuestdata->command != NULL)
331+
{
332+
free(issuestdata->command); // Free previous command before overwriting
333+
}
315334
issuestdata->command = strdup(tmpCommand); // print command info from json file
316335
cJSON_free(tmpCommand);
317336
}
@@ -322,6 +341,7 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
322341
{
323342
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: No Commands found, exiting.. \n",__FUNCTION__,__LINE__);
324343
free(issuestdata);
344+
return NULL;
325345
}
326346
else
327347
{
@@ -337,6 +357,7 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
337357
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Aborting Command execution due to Harmful commands!!!\n",__FUNCTION__,__LINE__);
338358
free(issuestdata->command);
339359
free(issuestdata);
360+
return NULL;
340361
}
341362
else
342363
{
@@ -415,6 +436,10 @@ bool invokeSanityandCommandExec(issueNodeData *issuestructNode, cJSON *jsoncfg,
415436
tmpCommand = cJSON_Print(elem);
416437
if(tmpCommand)
417438
{
439+
if(issuestdata->command != NULL)
440+
{
441+
free(issuestdata->command); // Free previous command before overwriting
442+
}
418443
issuestdata->command = strdup(tmpCommand); // print command info from json file
419444
cJSON_free(tmpCommand);
420445
}
@@ -425,6 +450,7 @@ bool invokeSanityandCommandExec(issueNodeData *issuestructNode, cJSON *jsoncfg,
425450
{
426451
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: No Commands found, exiting.. \n",__FUNCTION__,__LINE__);
427452
free(issuestdata);
453+
return NULL;
428454
}
429455
else
430456
{
@@ -449,6 +475,7 @@ bool invokeSanityandCommandExec(issueNodeData *issuestructNode, cJSON *jsoncfg,
449475
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Aborting Command execution due to Harmful commands!!!\n",__FUNCTION__,__LINE__);
450476
free(issuestdata->command);
451477
free(issuestdata);
478+
return NULL;
452479
}
453480
else
454481
{
@@ -486,6 +513,14 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
486513
struct tm *ltime;
487514
rfcbuf = strdup(buff->mdata);
488515

516+
if (rfcbuf == NULL)
517+
{
518+
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Memory allocation failed for rfcbuf\n",__FUNCTION__,__LINE__);
519+
free(buff->mdata); // free rfc data
520+
free(buff->jsonPath); // free rrd path info
521+
return;
522+
}
523+
489524
// Creating Directory for MainNode under /tmp/rrd Folder
490525
ctime = time (NULL);
491526
ltime = localtime (&ctime);
@@ -500,6 +535,7 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
500535
if (mkdir(outdir,0777) != 0)
501536
{
502537
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: %s Directory creation failed!!!\n",__FUNCTION__,__LINE__,outdir);
538+
free(rfcbuf); // free duplicated rfc data
503539
free(buff->mdata); // free rfc data
504540
free(buff->jsonPath); // free rrd path info
505541
return;
@@ -552,12 +588,16 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
552588
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: RRD Upload Script Execution Success...\n",__FUNCTION__,__LINE__);
553589
}
554590
}
591+
free(rfcbuf); // free duplicated rfc data
555592
free(buff->mdata); // free rfc data
556593
free(buff->jsonPath); // free rrd path info
557594
}
558595
else
559596
{
560597
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: No Command excuted as RRD Failed to change directory:%s\n",__FUNCTION__,__LINE__,outdir);
598+
free(rfcbuf); // free duplicated rfc data
599+
free(buff->mdata); // free rfc data
600+
free(buff->jsonPath); // free rrd path info
561601
}
562602
}
563603
}
@@ -634,7 +674,7 @@ bool processAllDebugCommand(cJSON *jsoncfg, issueNodeData *issuestructNode, char
634674
}
635675
}
636676
}
637-
free(rfcbuf); // free rfc value
677+
// Note: rfcbuf is owned by caller and will be freed there
638678
}
639679
else
640680
{

src/rrdRunCmdThread.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ static cacheData *cacheDataNode = NULL;
4040
void initCache(void)
4141
{
4242
pthread_mutex_init(&rrdCacheMut, NULL);
43+
pthread_mutex_lock(&rrdCacheMut);
4344
cacheDataNode = NULL;
45+
pthread_mutex_unlock(&rrdCacheMut);
4446
}
4547

4648
/*
@@ -375,8 +377,9 @@ bool executeCommands(issueData *cmdinfo)
375377
/*Executing Commands using systemd-run*/
376378
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: Executing following commands using systemd-run:\n \"%s\"\n",__FUNCTION__,__LINE__,cmdData->command);
377379

378-
strncpy(remoteDebuggerServiceStr, remoteDebuggerPrefix, strlen(remoteDebuggerPrefix) + 1);
379-
strncat(remoteDebuggerServiceStr, cmdData->rfcvalue, strlen(cmdData->rfcvalue));
380+
strncpy(remoteDebuggerServiceStr, remoteDebuggerPrefix, sizeof(remoteDebuggerServiceStr) - 1);
381+
remoteDebuggerServiceStr[sizeof(remoteDebuggerServiceStr) - 1] = '\0';
382+
strncat(remoteDebuggerServiceStr, cmdData->rfcvalue, sizeof(remoteDebuggerServiceStr) - strlen(remoteDebuggerServiceStr) - 1);
380383

381384
removeQuotes(cmdData->command);
382385

@@ -389,8 +392,8 @@ bool executeCommands(issueData *cmdinfo)
389392
{
390393
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: Starting remote_debugger_%s service success...\n",__FUNCTION__,__LINE__,cmdData->rfcvalue);
391394
copyDebugLogDestFile(systemdfp, filePointer);
395+
v_secure_pclose(systemdfp);
392396
}
393-
v_secure_pclose(systemdfp);
394397

395398
/*Logging output using journalctl to Output file*/
396399
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: Using journalctl to log command output...\n",__FUNCTION__,__LINE__);
@@ -403,9 +406,8 @@ bool executeCommands(issueData *cmdinfo)
403406
{
404407
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: journalctl remote_debugger_%s service success...\n",__FUNCTION__,__LINE__,cmdData->rfcvalue);
405408
copyDebugLogDestFile(journalctlfp, filePointer);
409+
v_secure_pclose(journalctlfp);
406410
}
407-
408-
v_secure_pclose(journalctlfp);
409411

410412
/* Close debug_output.txt file*/
411413
fclose(filePointer);

0 commit comments

Comments
 (0)