Skip to content

RDKB-65853: Fixing Vulnerability issue #1265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sshah500 wants to merge 2 commits into
base: develop
Choose a base branch
from
+120 −30
Open

RDKB-65853: Fixing Vulnerability issue #1265

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b927ae7
clean_up routine for ovsdb_translator
sshah500 Jun 30, 2026
89a81f9
HIGH patern 11 & 12
sshah500 Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 20 additions & 11 deletions source/core/wifi_ctrl_rbus_handlers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2846,7 +2846,7 @@ bus_error_t apply_ignite_config(char *paramName,
{
wifi_ctrl_t *ctrl = (wifi_ctrl_t *)get_wifictrl_obj();
wifi_mgr_t *mgr = (wifi_mgr_t *)get_wifimgr_obj();
webconfig_subdoc_data_t data;
webconfig_subdoc_data_t *data = NULL;
char *str;
unsigned int num_of_radios = getNumberRadios();

Expand All @@ -2862,13 +2862,19 @@ bus_error_t apply_ignite_config(char *paramName,
wifi_util_dbg_print(WIFI_CTRL, "%s:%d No pending changes\n", __func__, __LINE__);
return bus_error_success;
}

// Prepare data for encoding
memset(&data, 0, sizeof(webconfig_subdoc_data_t));
data.u.decoded.num_radios = num_of_radios;
/* Allocate on heap instead of stack */
data = (webconfig_subdoc_data_t *)malloc(sizeof(webconfig_subdoc_data_t));
if (data == NULL) {
pthread_mutex_unlock(&g_apply_ignite_config.lock); // IMPORTANT: unlock before return
wifi_util_error_print(WIFI_CTRL, "%s:%d malloc failed\n", __func__, __LINE__);
return bus_error_general;
}
//Prepare data for encoding
memset(data, 0, sizeof(webconfig_subdoc_data_t));
data->u.decoded.num_radios = num_of_radios;

// Copy pending config to data
memcpy(&data.u.decoded.ignite_config, &g_apply_ignite_config.config,
memcpy(data->u.decoded.ignite_config, &g_apply_ignite_config.config,
num_of_radios * sizeof(ignite_config_t));

// Clear dirty flag
Expand All @@ -2877,19 +2883,21 @@ bus_error_t apply_ignite_config(char *paramName,
pthread_mutex_unlock(&g_apply_ignite_config.lock);

// Encode and push to queue
if (webconfig_encode(&ctrl->webconfig, &data, webconfig_subdoc_type_ignite)
if (webconfig_encode(&ctrl->webconfig, data, webconfig_subdoc_type_ignite)
== webconfig_error_none) {
wifi_util_info_print(WIFI_CTRL, "%s:%d webconfig_encode success\n", __FUNCTION__, __LINE__);
str = (char *)data.u.encoded.raw;
push_event_to_ctrl_queue(str, strlen(str), wifi_event_type_webconfig,
str = (char *)data->u.encoded.raw;
push_event_to_ctrl_queue(str, strlen(str)+1, wifi_event_type_webconfig,
wifi_event_webconfig_set_ignite_data, NULL);
} else {
wifi_util_error_print(WIFI_CTRL, "%s:%d webconfig_encode failed\n", __func__, __LINE__);
webconfig_data_free(&data);
webconfig_data_free(data);
free(data);
return bus_error_general;
}

webconfig_data_free(&data);
webconfig_data_free(data);
free(data);
return bus_error_success;
}

Expand Down Expand Up @@ -4224,6 +4232,7 @@ bus_error_t set_force_vap_apply(char *name, raw_data_t *p_data, bus_user_data_t
push_event_to_ctrl_queue((const cJSON *)data->u.encoded.raw,
(strlen(data->u.encoded.raw) + 1), wifi_event_type_webconfig,
wifi_event_webconfig_set_data_force_apply, NULL);
webconfig_data_free(data);
free(data);
return bus_error_success;
}
Expand Down
119 changes: 100 additions & 19 deletions source/webconfig/wifi_ovsdb_translator.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4664,9 +4664,10 @@ webconfig_error_t translate_config_from_ovsdb_for_stats_config(webconfig_subdoc
const struct schema_Wifi_Stats_Config **table;
struct schema_Wifi_Stats_Config *config_row;
webconfig_external_ovsdb_t *proto;
stats_config_t *stat_config_entry;
stats_config_t *stat_config_entry = NULL;
stats_config_t temp_stat_config_entry;
unsigned int i = 0;
webconfig_error_t rc = webconfig_error_none;

proto = (webconfig_external_ovsdb_t *) data->u.decoded.external_protos;
if (proto == NULL) {
Expand All @@ -4691,26 +4692,45 @@ webconfig_error_t translate_config_from_ovsdb_for_stats_config(webconfig_subdoc
config_row = (struct schema_Wifi_Stats_Config *)table[i];
if (config_row == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: config_row is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}
memset(&temp_stat_config_entry, 0, sizeof(stats_config_t));
if (translate_statsconfig_from_ovsdb_to_rdk(config_row, &temp_stat_config_entry) != webconfig_error_none) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: translation of stat_config failed for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
}
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: translation of stat_config failed for %d\n", __func__, __LINE__, i);
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}
stat_config_entry = NULL;
stat_config_entry = (stats_config_t *)malloc(sizeof(stats_config_t));
if (stat_config_entry == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: stat_config is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}
memset(stat_config_entry, 0, sizeof(stats_config_t));
memcpy(stat_config_entry, &temp_stat_config_entry, sizeof(stats_config_t));
hash_map_put(data->u.decoded.stats_config_map, strdup(temp_stat_config_entry.stats_cfg_id), stat_config_entry);
stat_config_entry = NULL;
Comment on lines 4714 to +4716
Comment on lines 4713 to +4716
}

return webconfig_error_none;

cleanup:
/* free current allocation only */
if (stat_config_entry != NULL) {
free(stat_config_entry);
stat_config_entry = NULL;
}

/* simple map cleanup (important for leak fix) */
if (data->u.decoded.stats_config_map != NULL) {
hash_map_destroy(data->u.decoded.stats_config_map);
data->u.decoded.stats_config_map = NULL;
}
return rc;
}

webconfig_error_t translate_steerconfig_from_ovsdb_to_rdk(const struct schema_Band_Steering_Config *config_row, steering_config_t *st_cfg, wifi_platform_property_t *wifi_prop)
Expand Down Expand Up @@ -4778,10 +4798,11 @@ webconfig_error_t translate_config_from_ovsdb_for_steering_config(webconfig_sub
const struct schema_Band_Steering_Config **table;
struct schema_Band_Steering_Config *config_row;
webconfig_external_ovsdb_t *proto;
steering_config_t *steer_config_entry;
steering_config_t *steer_config_entry = NULL;
steering_config_t temp_steer_config;
unsigned int i = 0;
wifi_platform_property_t *wifi_prop = &data->u.decoded.hal_cap.wifi_prop;
webconfig_error_t rc = webconfig_error_none;

proto = (webconfig_external_ovsdb_t *) data->u.decoded.external_protos;
if (proto == NULL) {
Expand Down Expand Up @@ -4810,27 +4831,45 @@ webconfig_error_t translate_config_from_ovsdb_for_steering_config(webconfig_sub
config_row = (struct schema_Band_Steering_Config *)table[i];
if (config_row == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: config_row is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}


memset(&temp_steer_config, 0, sizeof(steering_config_t));
if (translate_steerconfig_from_ovsdb_to_rdk(config_row, &temp_steer_config, wifi_prop) != webconfig_error_none) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: translation of steer_config failed for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}

steer_config_entry = (steering_config_t *)malloc(sizeof(steering_config_t));
if (steer_config_entry == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: steer_config is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}
memset(steer_config_entry, 0, sizeof(steering_config_t));
memcpy(steer_config_entry, &temp_steer_config, sizeof(steering_config_t));
hash_map_put(data->u.decoded.steering_config_map, strdup(temp_steer_config.steering_cfg_id), steer_config_entry);
steer_config_entry = NULL;
Comment on lines 4852 to +4855
Comment on lines 4852 to +4855
}

return webconfig_error_none;

/* free current allocation */
cleanup:
if (steer_config_entry != NULL) {
free(steer_config_entry);
steer_config_entry = NULL;
}

/* destroy map (simple cleanup) */
if (data->u.decoded.steering_config_map != NULL) {
hash_map_destroy(data->u.decoded.steering_config_map);
data->u.decoded.steering_config_map = NULL;
}
return rc;
}

webconfig_error_t translate_steerconfig_from_rdk_to_ovsdb(struct schema_Band_Steering_Config *config_row, const steering_config_t *st_cfg, wifi_platform_property_t *wifi_prop)
Expand Down Expand Up @@ -5117,9 +5156,10 @@ webconfig_error_t translate_config_from_ovsdb_for_steering_clients(webconfig_su
const struct schema_Band_Steering_Clients **table;
struct schema_Band_Steering_Clients *client_row;
webconfig_external_ovsdb_t *proto;
band_steering_clients_t *steering_client_entry;
band_steering_clients_t *steering_client_entry = NULL;
band_steering_clients_t temp_steering_client;
unsigned int i = 0;
webconfig_error_t rc = webconfig_error_none;

proto = (webconfig_external_ovsdb_t *) data->u.decoded.external_protos;
if (proto == NULL) {
Expand All @@ -5143,26 +5183,45 @@ webconfig_error_t translate_config_from_ovsdb_for_steering_clients(webconfig_su
client_row = (struct schema_Band_Steering_Clients *)table[i];
if (client_row == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: client_row is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}

memset(&temp_steering_client, 0, sizeof(band_steering_clients_t));
if (translate_steeringclients_from_ovsdb_to_rdk(client_row, &temp_steering_client) != webconfig_error_none) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: translation of steer_config failed for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;
}

steering_client_entry = (band_steering_clients_t *)malloc(sizeof(band_steering_clients_t));
if (steering_client_entry == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: steer_config is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}
memset(steering_client_entry, 0, sizeof(band_steering_clients_t));
memcpy(steering_client_entry, &temp_steering_client, sizeof(band_steering_clients_t));
hash_map_put(data->u.decoded.steering_client_map, strdup(temp_steering_client.steering_client_id), steering_client_entry);
steering_client_entry = NULL;
Comment on lines 5204 to +5207
Comment on lines 5204 to +5207
}

return webconfig_error_none;

cleanup:
/* free current allocation */
if (steering_client_entry != NULL) {
free(steering_client_entry);
steering_client_entry = NULL;
}

/* destroy map to avoid partial leaks */
if (data->u.decoded.steering_client_map != NULL) {
hash_map_destroy(data->u.decoded.steering_client_map);
data->u.decoded.steering_client_map = NULL;
}
return rc;
}

webconfig_error_t translate_vif_neighbors_from_ovsdb_to_rdk(const struct schema_Wifi_VIF_Neighbors *neighbor_row, vif_neighbors_t *neighbor_cfg)
Expand Down Expand Up @@ -5200,9 +5259,10 @@ webconfig_error_t translate_config_from_ovsdb_for_vif_neighbors(webconfig_subdo
const struct schema_Wifi_VIF_Neighbors **table;
struct schema_Wifi_VIF_Neighbors *client_row;
webconfig_external_ovsdb_t *proto;
vif_neighbors_t *vif_neighbor_entry;
vif_neighbors_t *vif_neighbor_entry = NULL;
vif_neighbors_t temp_vif_neighbor;
unsigned int i = 0;
webconfig_error_t rc = webconfig_error_none;

proto = (webconfig_external_ovsdb_t *) data->u.decoded.external_protos;
if (proto == NULL) {
Expand All @@ -5226,26 +5286,47 @@ webconfig_error_t translate_config_from_ovsdb_for_vif_neighbors(webconfig_subdo
client_row = (struct schema_Wifi_VIF_Neighbors *)table[i];
if (client_row == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: client_row is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}

memset(&temp_vif_neighbor, 0, sizeof(vif_neighbors_t));
if (translate_vif_neighbors_from_ovsdb_to_rdk(client_row, &temp_vif_neighbor) != webconfig_error_none) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: translation of vif_neighbor failed for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}

vif_neighbor_entry = (vif_neighbors_t *)malloc(sizeof(vif_neighbors_t));
if (vif_neighbor_entry == NULL) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: steer_config is NULL for %d\n", __func__, __LINE__, i);
return webconfig_error_translate_from_ovsdb;
rc = webconfig_error_translate_from_ovsdb;
goto cleanup;

}
memset(vif_neighbor_entry, 0, sizeof(vif_neighbors_t));
memcpy(vif_neighbor_entry, &temp_vif_neighbor, sizeof(vif_neighbors_t));
hash_map_put(data->u.decoded.vif_neighbors_map, strdup(temp_vif_neighbor.neighbor_id), vif_neighbor_entry);
vif_neighbor_entry = NULL;
Comment on lines 5309 to +5312
Comment on lines 5309 to +5312
}

return webconfig_error_none;
cleanup:
/* free current allocation */
if (vif_neighbor_entry != NULL) {
free(vif_neighbor_entry);
vif_neighbor_entry = NULL;
}

/* destroy map on failure */
if (data->u.decoded.vif_neighbors_map != NULL) {
hash_map_destroy(data->u.decoded.vif_neighbors_map);
data->u.decoded.vif_neighbors_map = NULL;
}

return rc;
}


Expand Down
Loading