RDKB-65595 : [Risk-Critical] JST (Generic) Security Fuzzing Report - #34
Open
pavankumar464 wants to merge 4 commits into
Open
RDKB-65595 : [Risk-Critical] JST (Generic) Security Fuzzing Report#34pavankumar464 wants to merge 4 commits into
pavankumar464 wants to merge 4 commits into
Conversation
Fixed Heap Buffer Overflow in `do_openssl_verify_with_cert` Recommendation - Check `strlen(filepath) >= 7` before calling `memcmp`, or use `strncmp` which handles short strings safely Fixed Command Injection via `popen()` Recommendation - Never pass untrusted input to `popen()` — use `execve()` with argument arrays or sanitize input
|
📋 PR Format Reminder
Expected: |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses two security-fuzzing findings in the JST runtime: (1) avoiding unsafe prefix checks in do_openssl_verify_with_cert, and (2) removing shell-based command execution (popen) in favor of fork + exec* with basic input filtering.
Changes:
- Replaced
popen()-based execution indo_exec()withpipe()/fork()/execvp()and added helper routines for command validation and argv construction. - Switched certificate URI prefix check from
memcmp()tostrncmp()indo_openssl_verify_with_cert()to avoid short-string overreads. - Added supporting headers for the new process/spawn implementation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
source/jst_functions.c:138
- Same whitespace mismatch on the second tokenization pass: delimiters should match the whitespace accepted by is_exec_command_safe() to avoid inconsistent argv parsing for inputs containing '\v'/'\f'.
token = strtok_r(command_copy, " \t\r\n", &scan_ctx);
source/jst_functions.c:114
- build_exec_argv() allows any isspace() characters in is_exec_command_safe(), but tokenization only splits on " \t\r\n". This mismatch means inputs containing other whitespace (e.g., '\v' or '\f') are accepted as “safe” but won’t be tokenized as separate argv entries, leading to incorrect argv parsing.
This issue also appears on line 138 of the same file.
token = strtok_r(command_scan_copy, " \t\r\n", &scan_ctx);
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixed Heap Buffer Overflow in
do_openssl_verify_with_certRecommendation - Check
strlen(filepath) >= 7before callingmemcmp, or usestrncmpwhich handles short strings safelyFixed Command Injection via
popen()Recommendation - Never pass untrusted input to
popen()— useexecve()with argument arrays or sanitize input