Skip to content

Commit f1a5520

Browse files
melhar098melhar098
committed
RDK-52196: [SECVULN] Unsafe Use of strncpy C Functions
Reason for change: Resolve security vulnerabilities in rdkservices Test Procedure: See ticket Risks: Low Priority: P1 Signed-off-by: melhar098 <[email protected]>
1 parent b51aa5d commit f1a5520

24 files changed

+133
-44
lines changed

‎AVOutput/AVOutputTVHelper.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -659,6 +659,7 @@ namespace Plugin {
659659
}
660660
}
661661
strncpy(rfc_caller_id,PQFileName.c_str(),PQFileName.size());
662+
rfc_caller_id[sizeof(rfc_caller_id) - 1] = '\0';
662663
LOGINFO("%s : Default tvsettings file : %s\n",__FUNCTION__,rfc_caller_id);
663664
}
664665

@@ -1534,6 +1535,7 @@ namespace Plugin {
15341535
tr181ErrorCode_t err = getLocalParam(rfc_caller_id, tr181_param_name.c_str(), &param);
15351536
if ( err == tr181Success ) {
15361537
strncpy(picMode, param.value, strlen(param.value)+1);
1538+
picMode[strlen(param.value)] = '\0';
15371539
LOGINFO("getLocalParam success, mode = %s\n", picMode);
15381540
return 1;
15391541
}

‎AVOutput/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ All notable changes to this RDK Service will be documented in this file.
1515
* Changes in CHANGELOG should be updated when commits are added to the main or release branches. There should be one CHANGELOG entry per JIRA Ticket. This is not enforced on sprint branches since there could be multiple changes for the same JIRA ticket during development.
1616

1717
* For more details, refer to [versioning](https://github.com/rdkcentral/rdkservices#versioning) section under Main README.
18+
## [1.0.11] - 2025-01-02
19+
### Security
20+
- Resolved security vulnerabilities
21+
1822
## [1.0.10] - 2024-12-23
1923
### Added
2024
- ODM API removal changes phase 1

‎DisplaySettings/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ All notable changes to this RDK Service will be documented in this file.
1616

1717
* For more details, refer to [versioning](https://github.com/rdkcentral/rdkservices#versioning) section under Main README.
1818

19+
## [2.0.4] - 2025-01-02
20+
### Security
21+
- Resolved security vulnerabilities
22+
1923
## [2.0.3] - 2024-12-29
2024
### Removed
2125
- Removed irmgr references from rdkservices.

‎DisplaySettings/DisplaySettings.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ using namespace std;
8585

8686
#define API_VERSION_NUMBER_MAJOR 2
8787
#define API_VERSION_NUMBER_MINOR 0
88-
#define API_VERSION_NUMBER_PATCH 3
88+
#define API_VERSION_NUMBER_PATCH 4
8989

9090
static bool isCecEnabled = false;
9191
static bool isResCacheUpdated = false;
@@ -2268,6 +2268,7 @@ namespace WPEFramework {
22682268
{
22692269
IARM_Bus_PWRMgr_StandbyVideoState_Param_t param;
22702270
strncpy(param.port, portname.c_str(), PWRMGR_MAX_VIDEO_PORT_NAME_LENGTH);
2271+
param.port[sizeof(param.port) - 1] = '\0';
22712272
if(IARM_RESULT_SUCCESS != IARM_Bus_Call(IARM_BUS_PWRMGR_NAME, IARM_BUS_PWRMGR_API_GetStandbyVideoState, &param, sizeof(param)))
22722273
{
22732274
LOGERR("Port: %s. enable:%d", param.port, param.isEnabled);
@@ -2291,6 +2292,7 @@ namespace WPEFramework {
22912292
{
22922293
dsMgrStandbyVideoStateParam_t param;
22932294
strncpy(param.port, portname.c_str(), PWRMGR_MAX_VIDEO_PORT_NAME_LENGTH);
2295+
param.port[sizeof(param.port) - 1] = '\0';
22942296
if(IARM_RESULT_SUCCESS != IARM_Bus_Call(IARM_BUS_DSMGR_NAME, IARM_BUS_DSMGR_API_GetStandbyVideoState, &param, sizeof(param)))
22952297
{
22962298
LOGERR("Port: %s. enable:%d", param.port, param.isEnabled);

‎FrameRate/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ All notable changes to this RDK Service will be documented in this file.
1616

1717
* For more details, refer to [versioning](https://github.com/rdkcentral/rdkservices#versioning) section under Main README.
1818

19+
## [1.0.8] - 2025-01-02
20+
### Security
21+
- Resolved security vulnerabilities
22+
1923
## [1.0.7] - 2024-12-18
2024
### Removed
2125
- remove irmgr reference from rdkservices.

‎FrameRate/FrameRate.cpp‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151

5252
#define API_VERSION_NUMBER_MAJOR 1
5353
#define API_VERSION_NUMBER_MINOR 0
54-
#define API_VERSION_NUMBER_PATCH 7
54+
#define API_VERSION_NUMBER_PATCH 8
5555

5656
namespace WPEFramework
5757
{
@@ -461,7 +461,8 @@ namespace WPEFramework
461461
switch (eventId) {
462462
case IARM_BUS_DSMGR_EVENT_DISPLAY_FRAMRATE_PRECHANGE:
463463
IARM_Bus_DSMgr_EventData_t *eventData = (IARM_Bus_DSMgr_EventData_t *)data;
464-
strcpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate);
464+
strncpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate, sizeof(dispFrameRate));
465+
dispFrameRate[sizeof(dispFrameRate) - 1] = '\0';
465466
break;
466467
}
467468
}
@@ -487,7 +488,8 @@ namespace WPEFramework
487488
switch (eventId) {
488489
case IARM_BUS_DSMGR_EVENT_DISPLAY_FRAMRATE_POSTCHANGE:
489490
IARM_Bus_DSMgr_EventData_t *eventData = (IARM_Bus_DSMgr_EventData_t *)data;
490-
strcpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate);
491+
strncpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate, sizeof(dispFrameRate));
492+
dispFrameRate[sizeof(dispFrameRate) - 1] = '\0';
491493
break;
492494
}
493495
}

‎Miracast/CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ All notable changes to this RDK Service will be documented in this file.
1313
Changes in CHANGELOG should be updated when commits are added to the main or release branches. There should be one CHANGELOG entry per JIRA Ticket. This is not enforced on sprint branches since there could be multiple changes for the same JIRA ticket during development.
1414

1515
For more details, refer to versioning section under Main README.
16+
## [1.0.12] - 2025-01-02
17+
### Security
18+
- Resolved security vulnerabilities
19+
1620
## [1.0.11] - 2024-12-05
1721
### Fixed
1822
- Fixed the SIGILL crash while failed to unregister the Power Event.

‎Miracast/MiracastPlayer/MiracastPlayer.cpp‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,13 @@ namespace WPEFramework
187187
sink_dev_ip = device_parameters["sink_dev_ip"].String();
188188

189189
strncpy( rtsp_hldr_msgq_data.source_dev_ip, source_dev_ip.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_ip));
190+
rtsp_hldr_msgq_data.source_dev_ip[sizeof(rtsp_hldr_msgq_data.source_dev_ip) - 1] = '\0';
190191
strncpy( rtsp_hldr_msgq_data.source_dev_mac, source_dev_mac.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_mac));
192+
rtsp_hldr_msgq_data.source_dev_mac[sizeof(rtsp_hldr_msgq_data.source_dev_mac) - 1] = '\0';
191193
strncpy( rtsp_hldr_msgq_data.source_dev_name, source_dev_name.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_name));
194+
rtsp_hldr_msgq_data.source_dev_name[sizeof(rtsp_hldr_msgq_data.source_dev_name) - 1] = '\0';
192195
strncpy( rtsp_hldr_msgq_data.sink_dev_ip, sink_dev_ip.c_str() , sizeof(rtsp_hldr_msgq_data.sink_dev_ip));
196+
rtsp_hldr_msgq_data.sink_dev_ip[sizeof(rtsp_hldr_msgq_data.sink_dev_ip) - 1] = '\0';
193197

194198
rtsp_hldr_msgq_data.state = RTSP_START_RECEIVE_MSGS;
195199
success = true;
@@ -692,8 +696,10 @@ namespace WPEFramework
692696
}
693697
else
694698
{
695-
strcpy( stMsgQ.src_dev_name, client_name.c_str());
696-
strcpy( stMsgQ.src_dev_mac_addr, client_mac.c_str());
699+
strncpy( stMsgQ.src_dev_name, client_name.c_str(), sizeof(stMsgQ.src_dev_name));
700+
stMsgQ.src_dev_name[sizeof(stMsgQ.src_dev_name) - 1] = '\0';
701+
strncpy( stMsgQ.src_dev_mac_addr, client_mac.c_str(), sizeof(stMsgQ.src_dev_mac_addr));
702+
stMsgQ.src_dev_mac_addr[sizeof(stMsgQ.src_dev_mac_addr) - 1] = '\0';
697703

698704
MIRACASTLOG_INFO("Given 'NAME, MAC and state' are[%s-%s-%s]",
699705
client_name.c_str(),

‎Miracast/MiracastService/MiracastController.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,7 @@ void MiracastController::remove_P2PGroupInstance(void)
464464
if ( true == m_groupInfo->isGO )
465465
{
466466
strncpy( commandBuffer , "ps -ax | awk '/dnsmasq -p0 -i/ && !/grep/ {print $1}' | xargs kill -9" , sizeof(commandBuffer));
467+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
467468
MIRACASTLOG_INFO("Terminate old dnsmasq instance: [%s]",commandBuffer);
468469
MiracastCommon::execute_SystemCommand(commandBuffer);
469470
memset( commandBuffer , 0x00 , sizeof(commandBuffer));
@@ -475,6 +476,7 @@ void MiracastController::remove_P2PGroupInstance(void)
475476
else
476477
{
477478
strncpy( commandBuffer , "ps -ax | awk '/p2p_udhcpc/ && !/grep/ {print $1}' | xargs kill -9" , sizeof(commandBuffer));
479+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
478480
MIRACASTLOG_INFO("Terminate old udhcpc p2p instance : [%s]", commandBuffer);
479481
MiracastCommon::execute_SystemCommand(commandBuffer);
480482
}
@@ -518,7 +520,8 @@ void MiracastController::event_handler(P2P_EVENTS eventId, void *data, size_t le
518520
if (nullptr != m_controller_thread){
519521
controller_msgq_data.msg_type = P2P_MSG;
520522
controller_msgq_data.state = convertP2PtoSessionActions(eventId);
521-
strcpy(controller_msgq_data.msg_buffer, event_buffer.c_str());
523+
strncpy(controller_msgq_data.msg_buffer, event_buffer.c_str(), sizeof(controller_msgq_data.msg_buffer));
524+
controller_msgq_data.msg_buffer[sizeof(controller_msgq_data.msg_buffer) - 1] = '\0';
522525

523526
MIRACASTLOG_INFO("event_handler to Controller Action[%#08X] buffer:%s ", controller_msgq_data.state, event_buffer.c_str());
524527
m_controller_thread->send_message(&controller_msgq_data, sizeof(controller_msgq_data));
@@ -1394,6 +1397,7 @@ void MiracastController::restart_session_discovery(std::string& mac_address)
13941397
if ( !mac_address.empty())
13951398
{
13961399
strncpy(controller_msgq_data.source_dev_mac, mac_address.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1400+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
13971401
}
13981402
controller_msgq_data.state = CONTROLLER_RESTART_DISCOVERING;
13991403
send_thundermsg_to_controller_thread(controller_msgq_data);
@@ -1419,6 +1423,7 @@ void MiracastController::accept_client_connection(std::string is_accepted)
14191423
{
14201424
MIRACASTLOG_INFO("[MIRACAST_SERVICE_ACCEPT_CLIENT]");
14211425
strncpy(controller_msgq_data.source_dev_mac, m_current_device_mac_addr.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1426+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
14221427
controller_msgq_data.state = CONTROLLER_CONNECT_REQ_FROM_THUNDER;
14231428
}
14241429
else
@@ -1448,9 +1453,13 @@ void MiracastController::switch_launch_request_context(std::string& source_dev_i
14481453
sink_dev_ip.c_str(),
14491454
source_dev_name.c_str());
14501455
strncpy(controller_msgq_data.source_dev_ip, source_dev_ip.c_str(),sizeof(controller_msgq_data.source_dev_ip));
1456+
controller_msgq_data.source_dev_ip[sizeof(controller_msgq_data.source_dev_ip) - 1] = '\0';
14511457
strncpy(controller_msgq_data.source_dev_mac, source_dev_mac.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1458+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
14521459
strncpy(controller_msgq_data.source_dev_name, source_dev_name.c_str(),sizeof(controller_msgq_data.source_dev_name));
1460+
controller_msgq_data.source_dev_name[sizeof(controller_msgq_data.source_dev_name) - 1] = '\0';
14531461
strncpy(controller_msgq_data.sink_dev_ip, sink_dev_ip.c_str(),sizeof(controller_msgq_data.sink_dev_ip));
1462+
controller_msgq_data.sink_dev_ip[sizeof(controller_msgq_data.sink_dev_ip) - 1] = '\0';
14541463
controller_msgq_data.state = CONTROLLER_SWITCH_LAUNCH_REQ_CTX;
14551464
send_thundermsg_to_controller_thread(controller_msgq_data);
14561465
}

‎Miracast/MiracastService/MiracastService.cpp‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ using namespace std;
6060

6161
#define API_VERSION_NUMBER_MAJOR 1
6262
#define API_VERSION_NUMBER_MINOR 0
63-
#define API_VERSION_NUMBER_PATCH 11
63+
#define API_VERSION_NUMBER_PATCH 12
6464

6565
#define SERVER_DETAILS "127.0.0.1:9998"
6666
#define SYSTEM_CALLSIGN "org.rdk.System"
@@ -934,8 +934,10 @@ namespace WPEFramework
934934
}
935935
else
936936
{
937-
strcpy( stMsgQ.src_dev_name, client_name.c_str());
938-
strcpy( stMsgQ.src_dev_mac_addr, client_mac.c_str());
937+
strncpy( stMsgQ.src_dev_name, client_name.c_str(), sizeof(stMsgQ.src_dev_name));
938+
stMsgQ.src_dev_name[sizeof(stMsgQ.src_dev_name) - 1] = '\0';
939+
strncpy( stMsgQ.src_dev_mac_addr, client_mac.c_str(), sizeof(stMsgQ.src_dev_mac_addr));
940+
stMsgQ.src_dev_mac_addr[sizeof(stMsgQ.src_dev_mac_addr) - 1] = '\0';
939941

940942
MIRACASTLOG_INFO("Given [NAME-MAC-state] are[%s-%s-%s]",
941943
client_name.c_str(),
@@ -997,8 +999,10 @@ namespace WPEFramework
997999
}
9981000
else
9991001
{
1000-
strcpy( stMsgQ.src_dev_ip_addr, source_dev_ip.c_str());
1001-
strcpy( stMsgQ.sink_ip_addr, sink_dev_ip.c_str());
1002+
strncpy( stMsgQ.src_dev_ip_addr, source_dev_ip.c_str(), sizeof(stMsgQ.src_dev_ip_addr));
1003+
stMsgQ.src_dev_ip_addr[sizeof(stMsgQ.src_dev_ip_addr) - 1] = '\0';
1004+
strncpy( stMsgQ.sink_ip_addr, sink_dev_ip.c_str(), sizeof(stMsgQ.sink_ip_addr));
1005+
stMsgQ.sink_ip_addr[sizeof(stMsgQ.sink_ip_addr) - 1] = '\0';
10021006

10031007
MIRACASTLOG_INFO("Given [Src-Sink-IP] are [%s-%s]",
10041008
source_dev_ip.c_str(),
@@ -1048,6 +1052,7 @@ namespace WPEFramework
10481052
{
10491053
MIRACASTLOG_INFO("!!! NEED TO STOP ONGOING SESSION !!!");
10501054
strncpy(commandBuffer,"curl -H \"Authorization: Bearer `WPEFrameworkSecurityUtility | cut -d '\"' -f 4`\" --header \"Content-Type: application/json\" --request POST --data '{\"jsonrpc\":\"2.0\", \"id\":3,\"method\":\"org.rdk.MiracastPlayer.1.stopRequest\", \"params\":{\"reason\": \"NEW_CONNECTION\"}}' http://127.0.0.1:9998/jsonrpc",sizeof(commandBuffer));
1055+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
10511056
MIRACASTLOG_INFO("Stopping old Session by [%s]",commandBuffer);
10521057
MiracastCommon::execute_SystemCommand(commandBuffer);
10531058
sleep(1);

0 commit comments

Comments
 (0)