From cf96f0bdc85d25e4ddde8a8c5591bb073c4e6e2b Mon Sep 17 00:00:00 2001
From: Pavan Kumar <pavankumarreddy_balireddy@comcast.com>
Date: Wed, 22 Apr 2026 09:41:44 +0530
Subject: [PATCH 1/3] RDKB-63696 30% spike on CPU & Load average spike due to
 cpu_/usr/sbin/jst on TXB8 devices during stability test

---
 source/jst_cosa.c | 40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

diff --git a/source/jst_cosa.c b/source/jst_cosa.c
index 0e2428a..e42ab47 100644
--- a/source/jst_cosa.c
+++ b/source/jst_cosa.c
@@ -408,17 +408,39 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
                 &pInstNumList
             );
 
-    if (iReturn != CCSP_SUCCESS)
+    if (iReturn != CCSP_SUCCESS || InstNum == 0 || pInstNumList == NULL)
     {
         //AnscTraceWarning("Failed on CcspBaseIf_GetNextLevelInstances, error code = %d.\n", iReturn);
         //RETURN_STRING("ERROR: Failed on CcspBaseIf_GetNextLevelInstances",1);
         RETURN_STRING("");
     }
 
-    for(loop1=0,loop2=0; loop1<(InstNum); loop1++) 
+    /* Build comma-separated instance list safely */
+    for (loop1 = 0, loop2 = 0; loop1 < InstNum; loop1++)
     {
-        len =sprintf(&format_s[loop2],"%d,", pInstNumList[loop1]);
-        loop2=loop2+len;
+        if (loop2 >= (int)(sizeof(format_s) - 1))
+        {
+            break;
+        }
+
+        len = snprintf(
+                &format_s[loop2],
+                sizeof(format_s) - loop2,
+                "%u,",
+                pInstNumList[loop1]);
+
+        if (len <= 0)
+        {
+            break;
+        }
+
+        if (len >= (int)(sizeof(format_s) - loop2))
+        {
+            loop2 = sizeof(format_s) - 1;
+            break;
+        }
+
+        loop2 += len;
     }
 
     if (pInstNumList)
@@ -426,16 +448,16 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
         free(pInstNumList);
     }
 
-    //Place NULL char at the end of string
-    if (loop2 >= 1)
+    /* Remove trailing comma safely */
+    if (loop2 > 0 && format_s[loop2 - 1] == ',')
     {
-        format_s[loop2-1]=0;
+        format_s[loop2 - 1] = '\0';
     }
     else
     {
-        format_s[0]=0;
-        CosaPhpExtLog("loop2-1 is less than zero in format_s[]\n");
+        format_s[loop2] = '\0';
     }
+
     RETURN_STRING(format_s);
 }
 

From 923f0dbe6f8d87663843adbd7f82e8b48a423fc6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Apr 2026 13:29:21 +0000
Subject: [PATCH 2/3] RDKB-63696 Fix snprintf truncation: restore buffer to
 prev position on partial write

Agent-Logs-Url: https://github.com/rdkcentral/javascript-templates/sessions/b07b2c7c-4794-4cdb-8403-9638f88a16bf

Co-authored-by: pavankumar464 <57708013+pavankumar464@users.noreply.github.com>
---
 source/jst_cosa.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/source/jst_cosa.c b/source/jst_cosa.c
index e42ab47..82e8e81 100644
--- a/source/jst_cosa.c
+++ b/source/jst_cosa.c
@@ -418,6 +418,8 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
     /* Build comma-separated instance list safely */
     for (loop1 = 0, loop2 = 0; loop1 < InstNum; loop1++)
     {
+        unsigned int prev_loop2 = loop2;
+
         if (loop2 >= (int)(sizeof(format_s) - 1))
         {
             break;
@@ -436,7 +438,9 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
 
         if (len >= (int)(sizeof(format_s) - loop2))
         {
-            loop2 = sizeof(format_s) - 1;
+            /* Truncation: discard the partial write so only complete ids remain */
+            format_s[prev_loop2] = '\0';
+            loop2 = prev_loop2;
             break;
         }
 

From aaf0bab07246417caff5987eb7623d5cf777e421 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 24 Apr 2026 13:33:52 +0000
Subject: [PATCH 3/3] RDKB-63696 Free ppDestComponentName and ppDestPath on all
 return paths in getInstanceIds

Agent-Logs-Url: https://github.com/rdkcentral/javascript-templates/sessions/0728811d-414d-48f8-95c8-50d3dbebe5a6

Co-authored-by: pavankumar464 <57708013+pavankumar464@users.noreply.github.com>
---
 source/jst_cosa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/source/jst_cosa.c b/source/jst_cosa.c
index 82e8e81..b270bda 100644
--- a/source/jst_cosa.c
+++ b/source/jst_cosa.c
@@ -412,6 +412,8 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
     {
         //AnscTraceWarning("Failed on CcspBaseIf_GetNextLevelInstances, error code = %d.\n", iReturn);
         //RETURN_STRING("ERROR: Failed on CcspBaseIf_GetNextLevelInstances",1);
+        if (ppDestComponentName) { free(ppDestComponentName); ppDestComponentName = NULL; }
+        if (ppDestPath)          { free(ppDestPath);          ppDestPath = NULL; }
         RETURN_STRING("");
     }
 
@@ -452,6 +454,9 @@ static duk_ret_t getInstanceIds(duk_context *ctx)
         free(pInstNumList);
     }
 
+    if (ppDestComponentName) { free(ppDestComponentName); ppDestComponentName = NULL; }
+    if (ppDestPath)          { free(ppDestPath);          ppDestPath = NULL; }
+
     /* Remove trailing comma safely */
     if (loop2 > 0 && format_s[loop2 - 1] == ',')
     {