Skip to content

Commit f8a4ea8

Browse files
melhar098melhar098
committed
RDK-52196: [SECVULN] Unsafe Use of strncpy C Functions
Reason for change: Resolve security vulnerabilities in rdkservices Test Procedure: See ticket Risks: Low Priority: P1 Signed-off-by: melhar098 <[email protected]>
1 parent 1f502af commit f8a4ea8

File tree

13 files changed

+84
-35
lines changed

13 files changed

+84
-35
lines changed

‎AVOutput/AVOutputTVHelper.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -655,6 +655,7 @@ namespace Plugin {
655655
}
656656
}
657657
strncpy(rfc_caller_id,PQFileName.c_str(),PQFileName.size());
658+
rfc_caller_id[sizeof(rfc_caller_id) - 1] = '\0';
658659
LOGINFO("%s : Default tvsettings file : %s\n",__FUNCTION__,rfc_caller_id);
659660
}
660661

@@ -1417,6 +1418,7 @@ namespace Plugin {
14171418
tr181ErrorCode_t err = getLocalParam(rfc_caller_id, tr181_param_name.c_str(), &param);
14181419
if ( err == tr181Success ) {
14191420
strncpy(picMode, param.value, strlen(param.value)+1);
1421+
picMode[strlen(param.value)] = '\0';
14201422
LOGINFO("getLocalParam success, mode = %s\n", picMode);
14211423
return 1;
14221424
}

‎DisplaySettings/DisplaySettings.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2264,6 +2264,7 @@ namespace WPEFramework {
22642264
{
22652265
IARM_Bus_PWRMgr_StandbyVideoState_Param_t param;
22662266
strncpy(param.port, portname.c_str(), PWRMGR_MAX_VIDEO_PORT_NAME_LENGTH);
2267+
param.port[sizeof(param.port) - 1] = '\0';
22672268
if(IARM_RESULT_SUCCESS != IARM_Bus_Call(IARM_BUS_PWRMGR_NAME, IARM_BUS_PWRMGR_API_GetStandbyVideoState, &param, sizeof(param)))
22682269
{
22692270
LOGERR("Port: %s. enable:%d", param.port, param.isEnabled);
@@ -2287,6 +2288,7 @@ namespace WPEFramework {
22872288
{
22882289
dsMgrStandbyVideoStateParam_t param;
22892290
strncpy(param.port, portname.c_str(), PWRMGR_MAX_VIDEO_PORT_NAME_LENGTH);
2291+
param.port[sizeof(param.port) - 1] = '\0';
22902292
if(IARM_RESULT_SUCCESS != IARM_Bus_Call(IARM_BUS_DSMGR_NAME, IARM_BUS_DSMGR_API_GetStandbyVideoState, &param, sizeof(param)))
22912293
{
22922294
LOGERR("Port: %s. enable:%d", param.port, param.isEnabled);

‎FrameRate/FrameRate.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -461,7 +461,8 @@ namespace WPEFramework
461461
switch (eventId) {
462462
case IARM_BUS_DSMGR_EVENT_DISPLAY_FRAMRATE_PRECHANGE:
463463
IARM_Bus_DSMgr_EventData_t *eventData = (IARM_Bus_DSMgr_EventData_t *)data;
464-
strcpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate);
464+
strncpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate, sizeof(dispFrameRate));
465+
dispFrameRate[sizeof(dispFrameRate) - 1] = '\0';
465466
break;
466467
}
467468
}
@@ -487,7 +488,8 @@ namespace WPEFramework
487488
switch (eventId) {
488489
case IARM_BUS_DSMGR_EVENT_DISPLAY_FRAMRATE_POSTCHANGE:
489490
IARM_Bus_DSMgr_EventData_t *eventData = (IARM_Bus_DSMgr_EventData_t *)data;
490-
strcpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate);
491+
strncpy(dispFrameRate,eventData->data.DisplayFrameRateChange.framerate, sizeof(dispFrameRate));
492+
dispFrameRate[sizeof(dispFrameRate) - 1] = '\0';
491493
break;
492494
}
493495
}

‎Miracast/MiracastPlayer/MiracastPlayer.cpp‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,13 @@ namespace WPEFramework
187187
sink_dev_ip = device_parameters["sink_dev_ip"].String();
188188

189189
strncpy( rtsp_hldr_msgq_data.source_dev_ip, source_dev_ip.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_ip));
190+
rtsp_hldr_msgq_data.source_dev_ip[sizeof(rtsp_hldr_msgq_data.source_dev_ip) - 1] = '\0';
190191
strncpy( rtsp_hldr_msgq_data.source_dev_mac, source_dev_mac.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_mac));
192+
rtsp_hldr_msgq_data.source_dev_mac[sizeof(rtsp_hldr_msgq_data.source_dev_mac) - 1] = '\0';
191193
strncpy( rtsp_hldr_msgq_data.source_dev_name, source_dev_name.c_str() , sizeof(rtsp_hldr_msgq_data.source_dev_name));
194+
rtsp_hldr_msgq_data.source_dev_name[sizeof(rtsp_hldr_msgq_data.source_dev_name) - 1] = '\0';
192195
strncpy( rtsp_hldr_msgq_data.sink_dev_ip, sink_dev_ip.c_str() , sizeof(rtsp_hldr_msgq_data.sink_dev_ip));
196+
rtsp_hldr_msgq_data.sink_dev_ip[sizeof(rtsp_hldr_msgq_data.sink_dev_ip) - 1] = '\0';
193197

194198
rtsp_hldr_msgq_data.state = RTSP_START_RECEIVE_MSGS;
195199
success = true;
@@ -692,8 +696,10 @@ namespace WPEFramework
692696
}
693697
else
694698
{
695-
strcpy( stMsgQ.src_dev_name, client_name.c_str());
696-
strcpy( stMsgQ.src_dev_mac_addr, client_mac.c_str());
699+
strncpy( stMsgQ.src_dev_name, client_name.c_str(), sizeof(stMsgQ.src_dev_name));
700+
stMsgQ.src_dev_name[sizeof(stMsgQ.src_dev_name) - 1] = '\0';
701+
strncpy( stMsgQ.src_dev_mac_addr, client_mac.c_str(), sizeof(stMsgQ.src_dev_mac_addr));
702+
stMsgQ.src_dev_mac_addr[sizeof(stMsgQ.src_dev_mac_addr) - 1] = '\0';
697703

698704
MIRACASTLOG_INFO("Given 'NAME, MAC and state' are[%s-%s-%s]",
699705
client_name.c_str(),

‎Miracast/MiracastService/MiracastController.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,7 @@ void MiracastController::remove_P2PGroupInstance(void)
464464
if ( true == m_groupInfo->isGO )
465465
{
466466
strncpy( commandBuffer , "ps -ax | awk '/dnsmasq -p0 -i/ && !/grep/ {print $1}' | xargs kill -9" , sizeof(commandBuffer));
467+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
467468
MIRACASTLOG_INFO("Terminate old dnsmasq instance: [%s]",commandBuffer);
468469
MiracastCommon::execute_SystemCommand(commandBuffer);
469470
memset( commandBuffer , 0x00 , sizeof(commandBuffer));
@@ -475,6 +476,7 @@ void MiracastController::remove_P2PGroupInstance(void)
475476
else
476477
{
477478
strncpy( commandBuffer , "ps -ax | awk '/p2p_udhcpc/ && !/grep/ {print $1}' | xargs kill -9" , sizeof(commandBuffer));
479+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
478480
MIRACASTLOG_INFO("Terminate old udhcpc p2p instance : [%s]", commandBuffer);
479481
MiracastCommon::execute_SystemCommand(commandBuffer);
480482
}
@@ -518,7 +520,8 @@ void MiracastController::event_handler(P2P_EVENTS eventId, void *data, size_t le
518520
if (nullptr != m_controller_thread){
519521
controller_msgq_data.msg_type = P2P_MSG;
520522
controller_msgq_data.state = convertP2PtoSessionActions(eventId);
521-
strcpy(controller_msgq_data.msg_buffer, event_buffer.c_str());
523+
strncpy(controller_msgq_data.msg_buffer, event_buffer.c_str(), sizeof(controller_msgq_data.msg_buffer));
524+
controller_msgq_data.msg_buffer[sizeof(controller_msgq_data.msg_buffer) - 1] = '\0';
522525

523526
MIRACASTLOG_INFO("event_handler to Controller Action[%#08X] buffer:%s ", controller_msgq_data.state, event_buffer.c_str());
524527
m_controller_thread->send_message(&controller_msgq_data, sizeof(controller_msgq_data));
@@ -1394,6 +1397,7 @@ void MiracastController::restart_session_discovery(std::string& mac_address)
13941397
if ( !mac_address.empty())
13951398
{
13961399
strncpy(controller_msgq_data.source_dev_mac, mac_address.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1400+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
13971401
}
13981402
controller_msgq_data.state = CONTROLLER_RESTART_DISCOVERING;
13991403
send_thundermsg_to_controller_thread(controller_msgq_data);
@@ -1419,6 +1423,7 @@ void MiracastController::accept_client_connection(std::string is_accepted)
14191423
{
14201424
MIRACASTLOG_INFO("[MIRACAST_SERVICE_ACCEPT_CLIENT]");
14211425
strncpy(controller_msgq_data.source_dev_mac, m_current_device_mac_addr.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1426+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
14221427
controller_msgq_data.state = CONTROLLER_CONNECT_REQ_FROM_THUNDER;
14231428
}
14241429
else
@@ -1448,9 +1453,13 @@ void MiracastController::switch_launch_request_context(std::string& source_dev_i
14481453
sink_dev_ip.c_str(),
14491454
source_dev_name.c_str());
14501455
strncpy(controller_msgq_data.source_dev_ip, source_dev_ip.c_str(),sizeof(controller_msgq_data.source_dev_ip));
1456+
controller_msgq_data.source_dev_ip[sizeof(controller_msgq_data.source_dev_ip) - 1] = '\0';
14511457
strncpy(controller_msgq_data.source_dev_mac, source_dev_mac.c_str(),sizeof(controller_msgq_data.source_dev_mac));
1458+
controller_msgq_data.source_dev_mac[sizeof(controller_msgq_data.source_dev_mac) - 1] = '\0';
14521459
strncpy(controller_msgq_data.source_dev_name, source_dev_name.c_str(),sizeof(controller_msgq_data.source_dev_name));
1460+
controller_msgq_data.source_dev_name[sizeof(controller_msgq_data.source_dev_name) - 1] = '\0';
14531461
strncpy(controller_msgq_data.sink_dev_ip, sink_dev_ip.c_str(),sizeof(controller_msgq_data.sink_dev_ip));
1462+
controller_msgq_data.sink_dev_ip[sizeof(controller_msgq_data.sink_dev_ip) - 1] = '\0';
14541463
controller_msgq_data.state = CONTROLLER_SWITCH_LAUNCH_REQ_CTX;
14551464
send_thundermsg_to_controller_thread(controller_msgq_data);
14561465
}

‎Miracast/MiracastService/MiracastService.cpp‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -935,8 +935,10 @@ namespace WPEFramework
935935
}
936936
else
937937
{
938-
strcpy( stMsgQ.src_dev_name, client_name.c_str());
939-
strcpy( stMsgQ.src_dev_mac_addr, client_mac.c_str());
938+
strncpy( stMsgQ.src_dev_name, client_name.c_str(), sizeof(stMsgQ.src_dev_name));
939+
stMsgQ.src_dev_name[sizeof(stMsgQ.src_dev_name) - 1] = '\0';
940+
strncpy( stMsgQ.src_dev_mac_addr, client_mac.c_str(), sizeof(stMsgQ.src_dev_mac_addr));
941+
stMsgQ.src_dev_mac_addr[sizeof(stMsgQ.src_dev_mac_addr) - 1] = '\0';
940942

941943
MIRACASTLOG_INFO("Given [NAME-MAC-state] are[%s-%s-%s]",
942944
client_name.c_str(),
@@ -998,8 +1000,10 @@ namespace WPEFramework
9981000
}
9991001
else
10001002
{
1001-
strcpy( stMsgQ.src_dev_ip_addr, source_dev_ip.c_str());
1002-
strcpy( stMsgQ.sink_ip_addr, sink_dev_ip.c_str());
1003+
strncpy( stMsgQ.src_dev_ip_addr, source_dev_ip.c_str(), sizeof(stMsgQ.src_dev_ip_addr));
1004+
stMsgQ.src_dev_ip_addr[sizeof(stMsgQ.src_dev_ip_addr) - 1] = '\0';
1005+
strncpy( stMsgQ.sink_ip_addr, sink_dev_ip.c_str(), sizeof(stMsgQ.sink_ip_addr));
1006+
stMsgQ.sink_ip_addr[sizeof(stMsgQ.sink_ip_addr) - 1] = '\0';
10031007

10041008
MIRACASTLOG_INFO("Given [Src-Sink-IP] are [%s-%s]",
10051009
source_dev_ip.c_str(),
@@ -1049,6 +1053,7 @@ namespace WPEFramework
10491053
{
10501054
MIRACASTLOG_INFO("!!! NEED TO STOP ONGOING SESSION !!!");
10511055
strncpy(commandBuffer,"curl -H \"Authorization: Bearer `WPEFrameworkSecurityUtility | cut -d '\"' -f 4`\" --header \"Content-Type: application/json\" --request POST --data '{\"jsonrpc\":\"2.0\", \"id\":3,\"method\":\"org.rdk.MiracastPlayer.1.stopRequest\", \"params\":{\"reason\": \"NEW_CONNECTION\"}}' http://127.0.0.1:9998/jsonrpc",sizeof(commandBuffer));
1056+
commandBuffer[sizeof(commandBuffer) - 1] = '\0';
10521057
MIRACASTLOG_INFO("Stopping old Session by [%s]",commandBuffer);
10531058
MiracastCommon::execute_SystemCommand(commandBuffer);
10541059
sleep(1);

‎Network/Network.cpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -859,10 +859,15 @@ typedef struct _IARM_BUS_NetSrvMgr_Iface_EventData_t {
859859
iarmData.ipversion[sizeof(iarmData.ipversion) - 1] = '\0';
860860
iarmData.autoconfig = autoconfig;
861861
strncpy(iarmData.ipaddress, ipaddr.c_str(), 16);
862+
iarmData.ipaddress[sizeof(iarmData.ipaddress) - 1] = '\0';
862863
strncpy(iarmData.netmask, netmask.c_str(), 16);
864+
iarmData.netmask[sizeof(iarmData.netmask) - 1] = '\0';
863865
strncpy(iarmData.gateway, gateway.c_str(), 16);
866+
iarmData.gateway[sizeof(iarmData.gateway) - 1] = '\0';
864867
strncpy(iarmData.primarydns, primarydns.c_str(), 16);
868+
iarmData.primarydns[sizeof(iarmData.primarydns) - 1] = '\0';
865869
strncpy(iarmData.secondarydns, secondarydns.c_str(), 16);
870+
iarmData.secondarydns[sizeof(iarmData.secondarydns) - 1] = '\0';
866871
iarmData.isSupported = false;
867872

868873
if (!autoconfig)

‎StateObserver/StateObserver.cpp‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -813,8 +813,8 @@ namespace WPEFramework {
813813
{
814814
systemStates.dac_init_timestamp.state = state;
815815
systemStates.dac_init_timestamp.error = error;
816-
strncpy(systemStates.dac_init_timestamp.payload,payload,strlen(payload));
817-
systemStates.dac_init_timestamp.payload[strlen(payload)]='\0';
816+
strncpy(systemStates.dac_init_timestamp.payload,payload,sizeof(systemStates.dac_init_timestamp.payload));
817+
systemStates.dac_init_timestamp.payload[sizeof(systemStates.dac_init_timestamp.payload) - 1]='\0';
818818
if(StateObserver::_instance)
819819
StateObserver::_instance->setProp(params,SYSTEM_DAC_INIT_TIMESTAMP,state,error);
820820
string payload_str(payload);
@@ -825,8 +825,8 @@ namespace WPEFramework {
825825
case IARM_BUS_SYSMGR_SYSSTATE_CABLE_CARD_SERIAL_NO:
826826
{
827827
systemStates.card_serial_no.error =error;
828-
strncpy(systemStates.card_serial_no.payload,payload,strlen(payload));
829-
systemStates.card_serial_no.payload[strlen(payload)]='\0';
828+
strncpy(systemStates.card_serial_no.payload,payload,sizeof(systemStates.card_serial_no.payload));
829+
systemStates.card_serial_no.payload[sizeof(systemStates.card_serial_no.payload) - 1]='\0';
830830
params["propertyName"]=SYSTEM_CARD_SERIAL_NO;
831831
params["error"]=error;
832832
string payload_str(payload);
@@ -837,8 +837,8 @@ namespace WPEFramework {
837837
case IARM_BUS_SYSMGR_SYSSTATE_STB_SERIAL_NO:
838838
{
839839
systemStates.stb_serial_no.error =error;
840-
strncpy(systemStates.stb_serial_no.payload,payload,strlen(payload));
841-
systemStates.stb_serial_no.payload[strlen(payload)]='\0';
840+
strncpy(systemStates.stb_serial_no.payload,payload,sizeof(systemStates.stb_serial_no.payload));
841+
systemStates.stb_serial_no.payload[sizeof(systemStates.stb_serial_no.payload) - 1]='\0';
842842
params["propertyName"]=SYSTEM_STB_SERIAL_NO;
843843
params["error"]=error;
844844
string payload_str(payload);
@@ -973,8 +973,8 @@ namespace WPEFramework {
973973
case IARM_BUS_SYSMGR_SYSSTATE_ECM_MAC:
974974
{
975975
systemStates.ecm_mac.error =error;
976-
strncpy(systemStates.ecm_mac.payload,payload,strlen(payload));
977-
systemStates.ecm_mac.payload[strlen(payload)]='\0';
976+
strncpy(systemStates.ecm_mac.payload,payload,sizeof(systemStates.ecm_mac.payload));
977+
systemStates.ecm_mac.payload[sizeof(systemStates.ecm_mac.payload) - 1]='\0';
978978
params["propertyName"]=SYSTEM_ECM_MAC;
979979
params["error"]=error;
980980
string payload_str(payload);
@@ -986,8 +986,8 @@ namespace WPEFramework {
986986
{
987987
systemStates.ip_mode.state=state;
988988
systemStates.ip_mode.error =error;
989-
strncpy(systemStates.ip_mode.payload,payload,strlen(payload));
990-
systemStates.ip_mode.payload[strlen(payload)]='\0';
989+
strncpy(systemStates.ip_mode.payload,payload,sizeof(systemStates.ip_mode.payload));
990+
systemStates.ip_mode.payload[sizeof(systemStates.ip_mode.payload) - 1]='\0';
991991
if(StateObserver::_instance)
992992
StateObserver::_instance->setProp(params,SYSTEM_IP_MODE,state,error);
993993
string payload_str(payload);

‎SystemServices/SystemServices.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,6 +669,7 @@ namespace WPEFramework {
669669

670670
IARM_Bus_PWRMgr_RebootParam_t rebootParam;
671671
strncpy(rebootParam.requestor, "SystemServices", sizeof(rebootParam.requestor));
672+
rebootParam.requestor[sizeof(rebootParam.requestor) - 1] = '\0';
672673
strncpy(rebootParam.reboot_reason_custom, customReason.c_str(), sizeof(rebootParam.reboot_reason_custom));
673674
rebootParam.reboot_reason_custom[sizeof(rebootParam.reboot_reason_custom) - 1] = '\0';
674675
strncpy(rebootParam.reboot_reason_other, otherReason.c_str(), sizeof(rebootParam.reboot_reason_other));
@@ -1357,7 +1358,8 @@ namespace WPEFramework {
13571358
if((strBLSplashScreenPath != "") && fileExists)
13581359
{
13591360
IARM_Bus_MFRLib_SetBLSplashScreen_Param_t mfrparam;
1360-
std::strcpy(mfrparam.path, strBLSplashScreenPath.c_str());
1361+
std::strncpy(mfrparam.path, strBLSplashScreenPath.c_str(), sizeof(mfrparam.path));
1362+
mfrparam.path[sizeof(mfrparam.path) - 1] = '\0';
13611363
IARM_Result_t result = IARM_Bus_Call(IARM_BUS_MFRLIB_NAME, IARM_BUS_MFRLIB_API_SetBlSplashScreen, (void *)&mfrparam, sizeof(mfrparam));
13621364
if (result != IARM_RESULT_SUCCESS){
13631365
LOGERR("Update failed. path: %s, fileExists %s, IARM result %d ",strBLSplashScreenPath.c_str(),fileExists ? "true" : "false",result);

‎Warehouse/Warehouse.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,8 @@ namespace WPEFramework
331331
return false;
332332
}
333333

334-
strcpy(runScriptParam.script_path, script.c_str());
334+
strncpy(runScriptParam.script_path, script.c_str(), sizeof(runScriptParam.script_path));
335+
runScriptParam.script_path[sizeof(runScriptParam.script_path) - 1] = '\0';
335336
IARM_Bus_Call(IARM_BUS_SYSMGR_NAME, IARM_BUS_SYSMGR_API_RunScript, &runScriptParam, sizeof(runScriptParam));
336337
bool ok = runScriptParam.return_value == 0;
337338

0 commit comments

Comments
 (0)