From 1ec10bbf8446a0651d4193cda71a97db79887f84 Mon Sep 17 00:00:00 2001 From: Rajeev Katta Date: Tue, 2 Dec 2025 14:32:02 -0500 Subject: [PATCH 1/2] rbus: fixup reverse null check in rbusEvent_SubscribeEx Coverity issue ID: 140 (REVERSE_INULL) Fix generated by RDKDevPilot AI Bot (Validation Score: 95/100) The code was dereferencing response pointer at lines 5173 and 5179 before checking if it's NULL at line 5181. This is a logic error - if response was NULL, it would crash before reaching the NULL check. Fix: Added early NULL check before any dereference operations, with proper cleanup and error handling. Enhanced with return value checking for rbusMessage_GetInt32() calls and graceful degradation. Changes: - Added early NULL validation before dereferencing response - Cleanup on error: removes subscription entry and frees memory - Returns RBUS_ERROR_INVALID_RESPONSE on NULL response - Enhanced error checking for rbusMessage_GetInt32() calls - Graceful degradation with default subscriptionId=0 on failure - Comprehensive logging for troubleshooting Co-authored-by: rdkdevpilot --- src/rbus/rbus.c | 49 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 43 insertions(+), 6 deletions(-) diff --git a/src/rbus/rbus.c b/src/rbus/rbus.c index 1269f1e5..1b310a11 100644 --- a/src/rbus/rbus.c +++ b/src/rbus/rbus.c @@ -5168,18 +5168,55 @@ static rbusError_t rbusEvent_SubscribeWithRetries( subInternal->rawData = rawData; rtVector_PushBack(handleInfo->eventSubs, subInternal); HANDLE_EVENTSUBS_MUTEX_UNLOCK(handle); + + /* Validate response pointer before any dereference operations */ + if(!response) + { + RBUSLOG_ERROR("%s subscribe failed: null response received from provider", eventName); + + /* Cleanup: Remove the subscription entry that was just added */ + HANDLE_EVENTSUBS_MUTEX_LOCK(handle); + rtVector_RemoveItem(handleInfo->eventSubs, subInternal, rbusEventSubscription_compare); + HANDLE_EVENTSUBS_MUTEX_UNLOCK(handle); + + /* Free allocated subscription structure */ + free(subInternal); + + return RBUS_ERROR_INVALID_RESPONSE; + } + + /* Safe to dereference response now */ if(publishOnSubscribe) { - rbusMessage_GetInt32(response, &initial_value); - if(initial_value) + int result = rbusMessage_GetInt32(response, &initial_value); + if(result == RBUS_ERROR_SUCCESS && initial_value) { _master_event_callback_handler(NULL, eventName, response, userData); } + else if(result != RBUS_ERROR_SUCCESS) + { + RBUSLOG_WARN("%s subscribe: failed to get initial value from response (error=%d)", + eventName, result); + } } - rbusMessage_GetInt32(response, &subscriptionId); - subInternal->subscriptionId = subscriptionId; - if(response) - rbusMessage_Release(response); + + /* Extract subscription ID from response */ + int result = rbusMessage_GetInt32(response, &subscriptionId); + if(result == RBUS_ERROR_SUCCESS) + { + subInternal->subscriptionId = subscriptionId; + RBUSLOG_DEBUG("%s subscribe: assigned subscriptionId=%d", eventName, subscriptionId); + } + else + { + RBUSLOG_WARN("%s subscribe: failed to get subscription ID from response (error=%d), using default", + eventName, result); + subInternal->subscriptionId = 0; + } + + /* Release response message */ + rbusMessage_Release(response); + RBUSLOG_INFO("%s subscribe retries succeeded", eventName); return RBUS_ERROR_SUCCESS; } From a448a4b57269c36a38ef77b7d2dcb03fabca5d79 Mon Sep 17 00:00:00 2001 From: Rajeev Katta Date: Tue, 2 Dec 2025 14:40:38 -0500 Subject: [PATCH 2/2] Fix compilation errors: use correct function and constant names - Use rbusEventSubscriptionInternal_free instead of rbusEventSubscription_compare - Use RBUS_ERROR_INVALID_RESPONSE_FROM_DESTINATION instead of RBUS_ERROR_INVALID_RESPONSE - Remove redundant free(subInternal) as rtVector_RemoveItem already frees it --- src/rbus/rbus.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/rbus/rbus.c b/src/rbus/rbus.c index 1b310a11..4625f0f7 100644 --- a/src/rbus/rbus.c +++ b/src/rbus/rbus.c @@ -5176,13 +5176,10 @@ static rbusError_t rbusEvent_SubscribeWithRetries( /* Cleanup: Remove the subscription entry that was just added */ HANDLE_EVENTSUBS_MUTEX_LOCK(handle); - rtVector_RemoveItem(handleInfo->eventSubs, subInternal, rbusEventSubscription_compare); + rtVector_RemoveItem(handleInfo->eventSubs, subInternal, rbusEventSubscriptionInternal_free); HANDLE_EVENTSUBS_MUTEX_UNLOCK(handle); - /* Free allocated subscription structure */ - free(subInternal); - - return RBUS_ERROR_INVALID_RESPONSE; + return RBUS_ERROR_INVALID_RESPONSE_FROM_DESTINATION; } /* Safe to dereference response now */