Skip to content

RDKB-65853: Fixing Vulnerability issue #1284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sshah500 wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

RDKB-65853: Fixing Vulnerability issue #1284

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 25 additions & 13 deletions source/core/wifi_ctrl_rbus_handlers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2847,7 +2847,7 @@ bus_error_t apply_ignite_config(char *paramName,
{
wifi_ctrl_t *ctrl = (wifi_ctrl_t *)get_wifictrl_obj();
wifi_mgr_t *mgr = (wifi_mgr_t *)get_wifimgr_obj();
webconfig_subdoc_data_t data;
webconfig_subdoc_data_t *data = NULL;
char *str;
unsigned int num_of_radios = getNumberRadios();

Expand All @@ -2863,34 +2863,45 @@ bus_error_t apply_ignite_config(char *paramName,
wifi_util_dbg_print(WIFI_CTRL, "%s:%d No pending changes\n", __func__, __LINE__);
return bus_error_success;
}
/* Allocate on heap instead of stack */
data = (webconfig_subdoc_data_t *)malloc(sizeof(webconfig_subdoc_data_t));
if (data == NULL) {
pthread_mutex_unlock(&g_apply_ignite_config.lock); // IMPORTANT: unlock before return
wifi_util_error_print(WIFI_CTRL, "%s:%d malloc failed\n", __func__, __LINE__);
return bus_error_general;
}
//Prepare data for encoding
memset(data, 0, sizeof(webconfig_subdoc_data_t));
data->u.decoded.num_radios = num_of_radios;

// Prepare data for encoding
memset(&data, 0, sizeof(webconfig_subdoc_data_t));
data.u.decoded.num_radios = num_of_radios;

if (num_of_radios > MAX_NUM_RADIOS) {
wifi_util_error_print(WIFI_CTRL,"WIFI %s : Number of Radios %d exceeds supported %d Radios \n",__FUNCTION__, getNumberRadios(), MAX_NUM_RADIOS);
return RETURN_ERR;
}
Comment on lines +2877 to +2880
// Copy pending config to data
memcpy(&data.u.decoded.ignite_config, &g_apply_ignite_config.config,
memcpy(data->u.decoded.ignite_config, &g_apply_ignite_config.config,
num_of_radios * sizeof(ignite_config_t));
Comment thread
sshah500 marked this conversation as resolved.

// Clear dirty flag
g_apply_ignite_config.is_pending = false;

pthread_mutex_unlock(&g_apply_ignite_config.lock);

// Encode and push to queue
if (webconfig_encode(&ctrl->webconfig, &data, webconfig_subdoc_type_ignite)
if (webconfig_encode(&ctrl->webconfig, data, webconfig_subdoc_type_ignite)
== webconfig_error_none) {
wifi_util_info_print(WIFI_CTRL, "%s:%d webconfig_encode success\n", __FUNCTION__, __LINE__);
str = (char *)data.u.encoded.raw;
push_event_to_ctrl_queue(str, strlen(str), wifi_event_type_webconfig,
str = (char *)data->u.encoded.raw;
push_event_to_ctrl_queue(str, strlen(str)+1, wifi_event_type_webconfig,
wifi_event_webconfig_set_ignite_data, NULL);
} else {
wifi_util_error_print(WIFI_CTRL, "%s:%d webconfig_encode failed\n", __func__, __LINE__);
webconfig_data_free(&data);
webconfig_data_free(data);
free(data);
return bus_error_general;
}

webconfig_data_free(&data);
webconfig_data_free(data);
free(data);
return bus_error_success;
}

Expand Down Expand Up @@ -4222,9 +4233,10 @@ bus_error_t set_force_vap_apply(char *name, raw_data_t *p_data, bus_user_data_t
return bus_error_invalid_input;
}

push_event_to_ctrl_queue((const cJSON *)data->u.encoded.raw,
push_event_to_ctrl_queue(data->u.encoded.raw,
(strlen(data->u.encoded.raw) + 1), wifi_event_type_webconfig,
wifi_event_webconfig_set_data_force_apply, NULL);
webconfig_data_free(data);
free(data);
return bus_error_success;
}
Expand Down
Loading