From 215a87b352038a47cdc3194cba2b690c8739ba2c Mon Sep 17 00:00:00 2001 From: bharathivelp Date: Thu, 6 Aug 2026 16:33:00 +0530 Subject: [PATCH] RDKB-65853: Fixing coverity issue Reason for change: Fixing coverity issues. Test Procedure: Build should be successful and the regression test should also succeed Risks: Low Priority: P1 Signed-off-by: Velpula_Bharathi@comcast.com --- include/wifi_events.h | 1 + source/apps/wifi_apps_mgr.c | 6 ++++ source/core/wifi_events.c | 36 ++++++++++++++++++--- source/dml/wifi_ssp/ssp_loop.c | 14 ++++++-- source/webconfig/wifi_decoder.c | 2 +- source/webconfig/wifi_easymesh_translator.c | 6 ++++ 6 files changed, 58 insertions(+), 7 deletions(-) diff --git a/include/wifi_events.h b/include/wifi_events.h index 16c7ea5d7..cf90e428f 100644 --- a/include/wifi_events.h +++ b/include/wifi_events.h @@ -248,6 +248,7 @@ typedef struct { wifi_event_type_t event_type; wifi_event_subtype_t sub_type; wifi_event_route_t route; + unsigned int mon_data_len; union { wifi_monitor_data_t *mon_data; wifi_core_data_t core_data; diff --git a/source/apps/wifi_apps_mgr.c b/source/apps/wifi_apps_mgr.c index ae303eaea..e713ffd40 100644 --- a/source/apps/wifi_apps_mgr.c +++ b/source/apps/wifi_apps_mgr.c @@ -254,6 +254,12 @@ int apps_mgr_link_quality_event(wifi_apps_mgr_t *apps_mgr, wifi_event_type_t typ app = get_app_by_inst(apps_mgr, wifi_app_inst_link_quality); + if (app == NULL) { + wifi_util_error_print(WIFI_APPS, "%s %d assert - NULL Pointer\n", __FUNCTION__, __LINE__); + destroy_wifi_event(event); + return RETURN_ERR; + } + app->desc.event_fn(app, event); destroy_wifi_event(event); diff --git a/source/core/wifi_events.c b/source/core/wifi_events.c index 530bdc547..9b808d10d 100644 --- a/source/core/wifi_events.c +++ b/source/core/wifi_events.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -30,6 +31,29 @@ extern bool monitor_initialization_done; +static unsigned int monitor_event_payload_size(wifi_event_subtype_t sub_type) +{ + switch (sub_type) { + case wifi_event_monitor_csi_pinger: + return offsetof(wifi_monitor_data_t, u) + sizeof(csi_mon_t); + case wifi_event_monitor_stats_flag_change: + case wifi_event_monitor_radio_stats_flag_change: + case wifi_event_monitor_vap_stats_flag_change: + return offsetof(wifi_monitor_data_t, u) + sizeof(client_stats_enable_t); + case wifi_event_monitor_connect: + case wifi_event_monitor_disconnect: + case wifi_event_monitor_deauthenticate: + return offsetof(wifi_monitor_data_t, u) + sizeof(auth_deauth_dev_t); + case wifi_event_monitor_auth_req: + case wifi_event_monitor_assoc_req: + case wifi_event_monitor_reassoc_req: + case wifi_event_monitor_action_frame: + return offsetof(wifi_monitor_data_t, u) + sizeof(frame_data_t); + default: + return sizeof(wifi_monitor_data_t); + } +} + const char *wifi_event_type_to_string(wifi_event_type_t type) { #define DOC2S(x) \ @@ -262,7 +286,7 @@ int clone_wifi_event(wifi_event_t *event, wifi_event_t **clone) msg_len = sizeof(wifi_provider_response_t); } else { msg = event->u.mon_data; - msg_len = sizeof(wifi_monitor_data_t); + msg_len = event->mon_data_len ? event->mon_data_len : sizeof(wifi_monitor_data_t); } break; case wifi_event_type_analytic: @@ -358,6 +382,7 @@ wifi_event_t *create_wifi_event(unsigned int msg_len, wifi_event_type_t type, event = NULL; return NULL; } + event->mon_data_len = msg_len; } break; case wifi_event_type_csi: @@ -705,7 +730,8 @@ int copy_msg_to_event(const void *data, unsigned int msg_len, wifi_event_type_t sizeof(wifi_mon_stats_args_t)); event->u.provider_response->stat_array_size = response->stat_array_size; } else { - memcpy(event->u.mon_data, data, sizeof(wifi_monitor_data_t)); + memcpy(event->u.mon_data, data, msg_len); + event->mon_data_len = msg_len; } break; case wifi_event_type_analytic: @@ -837,6 +863,7 @@ int push_event_to_monitor_queue(wifi_monitor_data_t *mon_data, wifi_event_subtyp { wifi_monitor_t *monitor_param = (wifi_monitor_t *)get_wifi_monitor(); wifi_event_t *event; + unsigned int mon_data_len; bool is_limit_reached; /* Check if monitor queue is initialized */ @@ -851,13 +878,14 @@ int push_event_to_monitor_queue(wifi_monitor_data_t *mon_data, wifi_event_subtyp return RETURN_ERR; } - event = create_wifi_event(sizeof(wifi_monitor_data_t), wifi_event_type_monitor, sub_type); + mon_data_len = monitor_event_payload_size(sub_type); + event = create_wifi_event(mon_data_len, wifi_event_type_monitor, sub_type); if (event == NULL) { wifi_util_error_print(WIFI_CTRL, "%s %d data malloc null\n", __FUNCTION__, __LINE__); return RETURN_ERR; } - if (copy_msg_to_event(mon_data, sizeof(wifi_monitor_data_t), wifi_event_type_monitor, sub_type, + if (copy_msg_to_event(mon_data, mon_data_len, wifi_event_type_monitor, sub_type, rt, event) != RETURN_OK) { wifi_util_error_print(WIFI_CTRL, "%s %d unable to copy msg to event for sub_type : %s\n", __FUNCTION__, __LINE__, wifi_event_subtype_to_string(sub_type)); diff --git a/source/dml/wifi_ssp/ssp_loop.c b/source/dml/wifi_ssp/ssp_loop.c index 4416d6b40..29010d918 100644 --- a/source/dml/wifi_ssp/ssp_loop.c +++ b/source/dml/wifi_ssp/ssp_loop.c @@ -1201,6 +1201,7 @@ void Psm_Db_Write_MacFilter(wifi_mac_entry_param_t *mcfg) snprintf(temp_mac_entry->device_name, sizeof(temp_mac_entry->device_name), "%s", mcfg->device_name); } wifi_util_dbg_print(WIFI_PSM, "%s:%d mac entry already present\r\n",__func__, __LINE__); + free(mcfg_mac); return; } ret = set_psm_record_by_name((mcfg->vap_index + 1), (mac_psm_data->data_index + 1), MacFilter, mcfg->mac); @@ -1208,6 +1209,7 @@ void Psm_Db_Write_MacFilter(wifi_mac_entry_param_t *mcfg) temp_mac_entry = malloc(sizeof(wifi_mac_psm_param_t)); if (temp_mac_entry == NULL) { wifi_util_dbg_print(WIFI_PSM, "%s:%d malloc failure\r\n",__func__, __LINE__); + free(mcfg_mac); return; } temp_mac_entry->data_index = (mac_psm_data->data_index + 1); @@ -1215,7 +1217,12 @@ void Psm_Db_Write_MacFilter(wifi_mac_entry_param_t *mcfg) if (strlen(mcfg->device_name) != 0) { snprintf(temp_mac_entry->device_name, sizeof(temp_mac_entry->device_name), "%s", mcfg->device_name); } - hash_map_put(psm_mac_map, mcfg_mac, temp_mac_entry); + if (hash_map_put(psm_mac_map, mcfg_mac, temp_mac_entry) != 0) + { + wifi_util_error_print(WIFI_PSM, "%s:%d hash_map_put failed for mac filter entry\r\n", __func__, __LINE__); + return; + } + mcfg_mac = NULL; count = hash_map_count(psm_mac_map); update_macfilter_list((mcfg->vap_index + 1), count, psm_mac_map); } @@ -1250,7 +1257,10 @@ void Psm_Db_Write_MacFilter(wifi_mac_entry_param_t *mcfg) if (strlen(mcfg->device_name) != 0) { snprintf(temp_mac_entry->device_name, sizeof(temp_mac_entry->device_name), "%s", mcfg->device_name); } - hash_map_put(psm_mac_map, strdup(mcfg->mac), temp_mac_entry); + if (hash_map_put(psm_mac_map, strdup(mcfg->mac), temp_mac_entry) != 0) { + wifi_util_error_print(WIFI_PSM, "%s:%d hash_map_put failed for mac filter entry\r\n", __func__, __LINE__); + return; + } count = hash_map_count(psm_mac_map); update_macfilter_list( (mcfg->vap_index + 1), count, psm_mac_map); } diff --git a/source/webconfig/wifi_decoder.c b/source/webconfig/wifi_decoder.c index 5a2c04460..7dc3a532a 100644 --- a/source/webconfig/wifi_decoder.c +++ b/source/webconfig/wifi_decoder.c @@ -6031,7 +6031,7 @@ webconfig_error_t decode_assocdev_stats_object(wifi_provider_response_t **assoc_ free(*assoc_stats); *assoc_stats = NULL; wifi_util_info_print(WIFI_WEBCONFIG, "%s:%d: Associated Device stats array size is %d\n", - __func__, __LINE__, (*assoc_stats)->stat_array_size); + __func__, __LINE__, size); return webconfig_error_none; } else { client_stats_data = (wifi_associated_dev3_t *)malloc(sizeof(wifi_associated_dev3_t) * size); diff --git a/source/webconfig/wifi_easymesh_translator.c b/source/webconfig/wifi_easymesh_translator.c index 95d6451ff..fdf827b8c 100644 --- a/source/webconfig/wifi_easymesh_translator.c +++ b/source/webconfig/wifi_easymesh_translator.c @@ -1542,6 +1542,12 @@ webconfig_error_t translate_sta_object_to_easymesh_for_assocdev_stats(webconfig_ return webconfig_error_decode; } + if (params->collect_stats.stats == NULL) { + wifi_util_info_print(WIFI_WEBCONFIG, + "%s:%d: no associated device stats to translate\n", __func__, __LINE__); + return webconfig_error_translate_to_easymesh; + } + assoc_device_stats = (wifi_provider_response_t **)¶ms->collect_stats.stats; sta_size = (*assoc_device_stats)->stat_array_size;