RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

[im1308]

RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

---

RootCause and Fix:

---

The crash at len = strlen(value) is a stale-handle use-after-free. Host_GetEntry returns the row handle after releasing LmHostObjectMutex; the CCSP framework caches it and later calls Host_GetParamStringValue. If the LM background thread deletes/reallocates that host in between, pHost->pStringParaValue[i] is a non-NULL garbage pointer, so strlen faults. The value == NULL check can't catch it.

Adding a new helper IsValidHostHandle() to verify that the PLmObjectHost received through hInsContext still exists in lmHosts.hostArray[].
The validation is performed while holding LmHostObjectMutex, before dereferencing the host object.
If the handle is no longer valid, the function logs a warning, unlocks the mutex, and returns an error instead of dereferencing a potentially stale pointer.

Purpose: Prevent access to a stale PLmObjectHost in case the host entry was removed or replaced after Host_GetEntry() returned the handle.

[Copilot]

Pull request overview

This PR aims to prevent a CcspLMLite crash caused by stale (use-after-free) host instance handles being cached by the CCSP framework and later dereferenced in Host_GetParamStringValue().

Changes:

• Adds IsValidHostHandle() to validate hInsContext (as PLmObjectHost) against lmHosts.hostArray[] under LmHostObjectMutex.
• Adds a guard in Host_GetParamStringValue() to bail out early when a stale host handle is detected.
• Updates GetParamStringValue_common() to use strnlen() (but this currently breaks required-size reporting semantics).

Comments suppressed due to low confidence (1)

source/lm/cosa_hosts_dml.c:156

• strnlen(value, *pUlSize) breaks the TR-181/CCSP GetParamStringValue contract for required-size reporting: when the string is longer than the buffer, strnlen returns *pUlSize, so the code only bumps *pUlSize by 1 instead of returning the full required length. Callers that reallocate and retry once will still fail for long strings.

        len = strnlen(value, *pUlSize); 
        if (len >= *pUlSize)
        {
            *pUlSize = len + 1;
            rc = 1;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.