Skip to content

RDK-60307 [RRD] RDK Coverity Defect Resolution for Device Management #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shibu-kv merged 2 commits into from
Feb 25, 2026
Merged

RDK-60307 [RRD] RDK Coverity Defect Resolution for Device Management #175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fbb2a00
RDK-60307 [RRD] RDK Coverity Defect Resolution for Device Management
Feb 3, 2026
0a67256
Merge branch 'develop' into feature/RDK-60307
madhubabutt Feb 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 116 additions & 19 deletions src/rrdEventProcess.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,31 +164,126 @@ static void processIssueType(data_buf *rbuf)
if (staticprofiledata == NULL)
{
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Static Command Info not found for IssueType!!! \n", __FUNCTION__, __LINE__);
// Free dynamicprofiledata since we can't proceed
if (dynamicprofiledata != NULL)
{
if (dynamicprofiledata->rfcvalue != NULL)
{
free(dynamicprofiledata->rfcvalue);
}
if (dynamicprofiledata->command != NULL)
{
free(dynamicprofiledata->command);
}
free(dynamicprofiledata);
}
}
else
{
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Read complete for Static Profile: RFCValue: %s, Command: %s, Timeout: %d... \n", __FUNCTION__, __LINE__, staticprofiledata->rfcvalue, staticprofiledata->command, staticprofiledata->timeout);
//Remove the double quotes
size_t staticstrlen = strlen(staticprofiledata->command);
size_t dynamicstrlen = strlen(dynamicprofiledata->command);
if (staticstrlen > 0 && staticprofiledata->command[staticstrlen - 1] == '"') {
staticprofiledata->command[staticstrlen - 1] = '\0';
}
if (dynamicprofiledata->command[0] == '"') {
dynamicprofiledata->command[0] = COMMAND_DELIM;

// Check if commands are NULL before using them
if (dynamicprofiledata->command == NULL || staticprofiledata->command == NULL)
{
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: Command is NULL in dynamic or static profile... \n", __FUNCTION__, __LINE__);
// Free dynamicprofiledata
if (dynamicprofiledata != NULL)
{
if (dynamicprofiledata->rfcvalue != NULL)
{
free(dynamicprofiledata->rfcvalue);
}
if (dynamicprofiledata->command != NULL)
{
free(dynamicprofiledata->command);
}
free(dynamicprofiledata);
}
// Free staticprofiledata
if (staticprofiledata != NULL)
{
if (staticprofiledata->rfcvalue != NULL)
{
free(staticprofiledata->rfcvalue);
}
if (staticprofiledata->command != NULL)
{
free(staticprofiledata->command);
}
free(staticprofiledata);
}
}
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Static Profile Commands: %s, Dynamic Profile Commands: %s\n", __FUNCTION__, __LINE__, staticprofiledata->command, dynamicprofiledata->command);

size_t appendstrlen = ((staticstrlen - 1) + dynamicstrlen + 1);
char *appendcommandstr = (char *)realloc(staticprofiledata->command, appendstrlen);
if (appendcommandstr == NULL) {
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Memory Allocation Failed... \n", __FUNCTION__, __LINE__);
else
{
//Remove the double quotes
size_t staticstrlen = strlen(staticprofiledata->command);
size_t dynamicstrlen = strlen(dynamicprofiledata->command);
if (staticstrlen > 0 && staticprofiledata->command[staticstrlen - 1] == '"') {
staticprofiledata->command[staticstrlen - 1] = '\0';
staticstrlen--; // Update length after removing trailing quote
}
if (dynamicprofiledata->command[0] == '"') {
dynamicprofiledata->command[0] = COMMAND_DELIM;
}
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Static Profile Commands: %s, Dynamic Profile Commands: %s\n", __FUNCTION__, __LINE__, staticprofiledata->command, dynamicprofiledata->command);

size_t appendstrlen = (staticstrlen + dynamicstrlen + 1);
char *appendcommandstr = (char *)realloc(staticprofiledata->command, appendstrlen);
if (appendcommandstr == NULL) {
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: Memory Allocation Failed... \n", __FUNCTION__, __LINE__);
// Free staticprofiledata on realloc failure
if (staticprofiledata != NULL)
{
if (staticprofiledata->rfcvalue != NULL)
{
free(staticprofiledata->rfcvalue);
}
if (staticprofiledata->command != NULL)
{
free(staticprofiledata->command);
}
free(staticprofiledata);
staticprofiledata = NULL; // Set to NULL to prevent double-free
}
// Free dynamicprofiledata on realloc failure
if (dynamicprofiledata != NULL)
{
if (dynamicprofiledata->rfcvalue != NULL)
{
free(dynamicprofiledata->rfcvalue);
}
if (dynamicprofiledata->command != NULL)
{
free(dynamicprofiledata->command);
}
free(dynamicprofiledata);
dynamicprofiledata = NULL; // Set to NULL to prevent double-free
}
}
else
{
strcat(appendcommandstr, dynamicprofiledata->command);
staticprofiledata->command = appendcommandstr;
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Updated command after append from dynamic and static profile: %s \n", __FUNCTION__, __LINE__, staticprofiledata->command);
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Executing Commands in Runtime Service... \n",__FUNCTION__,__LINE__);
checkIssueNodeInfo(pIssueNode, NULL, rbuf, false, staticprofiledata);
// NOTE: staticprofiledata is freed by executeCommands() via checkIssueNodeInfo()
// Do NOT free staticprofiledata here to avoid double-free
}
// Free dynamicprofiledata after use
if (dynamicprofiledata != NULL)
{
if (dynamicprofiledata->rfcvalue != NULL)
{
free(dynamicprofiledata->rfcvalue);
}
if (dynamicprofiledata->command != NULL)
{
free(dynamicprofiledata->command);
}
free(dynamicprofiledata);
}
}
strcat(appendcommandstr, dynamicprofiledata->command);
staticprofiledata->command = appendcommandstr;
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: Updated command after append from dynamic and static profile: %s \n", __FUNCTION__, __LINE__, staticprofiledata->command);
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Executing Commands in Runtime Service... \n",__FUNCTION__,__LINE__);
checkIssueNodeInfo(pIssueNode, NULL, rbuf, false, staticprofiledata);
}
}
}
Expand Down Expand Up @@ -303,6 +398,8 @@ static void processIssueTypeInStaticProfile(data_buf *rbuf, issueNodeData *pIssu
{ // Static Profile JSON Parsing or Read Fail
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: Static Profile Parse/Read failed... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);
processIssueTypeInInstalledPackage(rbuf, pIssueNode);
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: ...Exiting...\n", __FUNCTION__, __LINE__);
return;
}
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Static Profile Parse And Read Success... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Check if Issue in Parsed Static JSON... %s\n", __FUNCTION__, __LINE__, RRD_JSON_FILE);
Expand Down
1 change: 1 addition & 0 deletions src/rrdIarmEvents.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,6 +352,7 @@ void _rdmManagerEventHandler(const char *owner, IARM_EventId_t eventId, void *da
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Copying Message Received to the queue.. \n", __FUNCTION__, __LINE__);
RRDMsgDeliver(msqid, sendbuf);
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: SUCCESS: Message sending Done, ID=%d MSG=%s Size=%d Type=%u AppendMode=%d! \n", __FUNCTION__, __LINE__, msqid, sendbuf->mdata, strlen(sendbuf->mdata), sendbuf->mtype, sendbuf->appendMode);
/* coverity[leaked_storage] */
}
else
{
Expand Down
6 changes: 5 additions & 1 deletion src/rrdInterface.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,6 +300,7 @@ void _rdmDownloadEventHandler(rbusHandle_t handle, rbusEvent_t const* event, rbu
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: Copying Message Received to the queue.. \n", __FUNCTION__, __LINE__);
RRDMsgDeliver(msqid, sendbuf);
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: SUCCESS: Message sending Done, ID=%d MSG=%s Size=%d Type=%u AppendMode=%d! \n", __FUNCTION__, __LINE__, msqid, sendbuf->mdata, strlen(sendbuf->mdata), sendbuf->mtype, sendbuf->appendMode);
/* coverity[leaked_storage] */
remove_item(cache);
}
else
Expand Down Expand Up @@ -338,10 +339,12 @@ void _remoteDebuggerEventHandler(rbusHandle_t handle, rbusEvent_t const* event,
if (dataMsg[0] == '\0' || len <= 0 )
{
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]: Message Received is empty, Exit Processing!!! \n", __FUNCTION__, __LINE__);
free(dataMsg);
}
else
{
pushIssueTypesToMsgQueue(dataMsg, EVENT_MSG);
/* coverity[leaked_storage] */
}

RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: ...Exiting...\n", __FUNCTION__, __LINE__);
Expand Down Expand Up @@ -393,6 +396,7 @@ void pushIssueTypesToMsgQueue(char *issueTypeList, message_type_et sndtype)
}
RRDMsgDeliver(msqid, sbuf);
RDK_LOG(RDK_LOG_INFO, LOG_REMDEBUG, "[%s:%d]: SUCCESS: Message sending Done, ID=%d MSG=%s Size=%d Type=%u AppendMode=%d! \n", __FUNCTION__, __LINE__, msqid, sbuf->mdata, strlen(sbuf->mdata), sbuf->mtype, sbuf->appendMode);
/* coverity[leaked_storage] */
}
}

Expand All @@ -417,7 +421,7 @@ int RRD_unsubscribe()
RDK_LOG(RDK_LOG_DEBUG, LOG_REMDEBUG, "[%s:%d]: SUCCESS: IARM_Bus Unsubscribe done!\n", __FUNCTION__, __LINE__);
#endif
#if !defined(GTEST_ENABLE)
rbusEvent_UnsubscribeEx(rrdRbusHandle, subscriptions, 3);
ret = rbusEvent_UnsubscribeEx(rrdRbusHandle, subscriptions, 3);
if (ret != 0)
{
RDK_LOG(RDK_LOG_ERROR, LOG_REMDEBUG, "[%s:%d]: RBUS Unsubscribe EventHandler for RRD failed!!! \n", __FUNCTION__, __LINE__);
Expand Down
43 changes: 41 additions & 2 deletions src/rrdJsonParser.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,22 @@ char * readJsonFile(char *jsonfile)
}
fseek(fp, 0, SEEK_SET);
jsonfile_content = (char *) malloc(sizeof(char) * (ch_count + 1));
fread(jsonfile_content, 1, ch_count,fp);
if (jsonfile_content == NULL)
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Memory allocation failed for json file %s \n",__FUNCTION__,__LINE__,jsonfile);
fclose(fp);
return NULL;
}

size_t bytes_read = fread(jsonfile_content, 1, ch_count, fp);
if (bytes_read != (size_t)ch_count)
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Failed to read json file %s. Expected %d bytes, read %zu bytes \n",__FUNCTION__,__LINE__,jsonfile,ch_count,bytes_read);
free(jsonfile_content);
fclose(fp);
return NULL;
}

jsonfile_content[ch_count] ='\0';
fclose(fp);

Expand Down Expand Up @@ -312,6 +327,10 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
tmpCommand = cJSON_Print(elem);
if(tmpCommand)
{
if(issuestdata->command != NULL)
{
free(issuestdata->command); // Free previous command before overwriting
}
issuestdata->command = strdup(tmpCommand); // print command info from json file
cJSON_free(tmpCommand);
}
Expand All @@ -322,6 +341,7 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: No Commands found, exiting.. \n",__FUNCTION__,__LINE__);
free(issuestdata);
issuestdata = NULL;
}
else
{
Expand All @@ -337,6 +357,7 @@ issueData * getIssueCommandInfo(issueNodeData *issuestructNode, cJSON *jsoncfg,
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Aborting Command execution due to Harmful commands!!!\n",__FUNCTION__,__LINE__);
free(issuestdata->command);
free(issuestdata);
issuestdata = NULL;
}
else
{
Expand Down Expand Up @@ -415,6 +436,10 @@ bool invokeSanityandCommandExec(issueNodeData *issuestructNode, cJSON *jsoncfg,
tmpCommand = cJSON_Print(elem);
if(tmpCommand)
{
if(issuestdata->command != NULL)
{
free(issuestdata->command); // Free previous command before overwriting
}
issuestdata->command = strdup(tmpCommand); // print command info from json file
cJSON_free(tmpCommand);
}
Expand Down Expand Up @@ -486,6 +511,14 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
struct tm *ltime;
rfcbuf = strdup(buff->mdata);

if (rfcbuf == NULL)
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: Memory allocation failed for rfcbuf\n",__FUNCTION__,__LINE__);
free(buff->mdata); // free rfc data
free(buff->jsonPath); // free rrd path info
return;
}

// Creating Directory for MainNode under /tmp/rrd Folder
ctime = time (NULL);
ltime = localtime (&ctime);
Expand All @@ -500,6 +533,7 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
if (mkdir(outdir,0777) != 0)
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: %s Directory creation failed!!!\n",__FUNCTION__,__LINE__,outdir);
free(rfcbuf); // free duplicated rfc data
free(buff->mdata); // free rfc data
free(buff->jsonPath); // free rrd path info
return;
Expand Down Expand Up @@ -552,12 +586,16 @@ void checkIssueNodeInfo(issueNodeData *issuestructNode, cJSON *jsoncfg, data_buf
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]: RRD Upload Script Execution Success...\n",__FUNCTION__,__LINE__);
}
}
free(rfcbuf); // free duplicated rfc data
free(buff->mdata); // free rfc data
free(buff->jsonPath); // free rrd path info
}
else
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]: No Command excuted as RRD Failed to change directory:%s\n",__FUNCTION__,__LINE__,outdir);
free(rfcbuf); // free duplicated rfc data
free(buff->mdata); // free rfc data
free(buff->jsonPath); // free rrd path info
}
}
}
Expand Down Expand Up @@ -634,7 +672,8 @@ bool processAllDebugCommand(cJSON *jsoncfg, issueNodeData *issuestructNode, char
}
}
}
free(rfcbuf); // free rfc value
// Note: rfcbuf is owned by the caller; this function must not free it.
// The caller is responsible for freeing rfcbuf after this function returns.
}
else
{
Expand Down
4 changes: 2 additions & 2 deletions src/rrdMain.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,11 +149,11 @@ int main(int argc, char *argv[])
/* Check RRD Enable RFC */
bool isEnabled = isRRDEnabled();
if(!isEnabled) {
RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]:RFC is disabled, stopping remote-debugger\n", __FUNCTION__, __LINE__);
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]:RFC is disabled, stopping remote-debugger\n", __FUNCTION__, __LINE__);
exit(0);
}

RDK_LOG(RDK_LOG_DEBUG,LOG_REMDEBUG,"[%s:%d]:Starting RDK Remote Debugger Daemon \n",__FUNCTION__,__LINE__);
RDK_LOG(RDK_LOG_INFO,LOG_REMDEBUG,"[%s:%d]:Starting RDK Remote Debugger Daemon \n",__FUNCTION__,__LINE__);
if ((msqid = msgget(key, IPC_CREAT | 0666 )) < 0)
{
RDK_LOG(RDK_LOG_ERROR,LOG_REMDEBUG,"[%s:%d]:Message Queue ID Creation failed, msqid=%d!!!\n",__FUNCTION__,__LINE__,msqid);
Expand Down
Loading
Loading