RDKB-65595 : [Risk-Critical] JST (Generic) Security Fuzzing Report

[pavankumar464]

Fixed Heap Buffer Overflow in do_openssl_verify_with_cert
Recommendation - Check strlen(filepath) >= 7 before calling memcmp, or use strncmp which handles short strings safely

Fixed Command Injection via popen()
Recommendation - Never pass untrusted input to popen() — use execve() with argument arrays or sanitize input

[github-actions]

📋 PR Format Reminder

• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

This PR addresses two security-fuzzing findings in the JST runtime: (1) avoiding unsafe prefix checks in do_openssl_verify_with_cert, and (2) removing shell-based command execution (popen) in favor of fork + exec* with basic input filtering.

Changes:

• Replaced popen()-based execution in do_exec() with pipe()/fork()/execvp() and added helper routines for command validation and argv construction.
• Switched certificate URI prefix check from memcmp() to strncmp() in do_openssl_verify_with_cert() to avoid short-string overreads.
• Added supporting headers for the new process/spawn implementation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

source/jst_functions.c:138

• Same whitespace mismatch on the second tokenization pass: delimiters should match the whitespace accepted by is_exec_command_safe() to avoid inconsistent argv parsing for inputs containing '\v'/'\f'.

  token = strtok_r(command_copy, " \t\r\n", &scan_ctx);

source/jst_functions.c:114

• build_exec_argv() allows any isspace() characters in is_exec_command_safe(), but tokenization only splits on " \t\r\n". This mismatch means inputs containing other whitespace (e.g., '\v' or '\f') are accepted as “safe” but won’t be tokenized as separate argv entries, leading to incorrect argv parsing.

This issue also appears on line 138 of the same file.

  token = strtok_r(command_scan_copy, " \t\r\n", &scan_ctx);