Fuzzing#1163
Open
Atchaya-Sivagnanam wants to merge 8 commits into
Open
Conversation
Reason for change: Fix memory issue identified through fuzz testing. Test Procedure: Debug Priority: P1 Risks: Low Signed-off-by: Atchaya Sivagnanam Atchaya_Sivagnanam@comcast.com
Reason for change: Fix memory issue identified through fuzz testing. Test Procedure: Debug Priority: P1 Risks: Low Signed-off-by: Atchaya Sivagnanam Atchaya_Sivagnanam@comcast.com
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses multiple memory-safety issues surfaced by libFuzzer across the webconfig encoder/decoder and WiFi monitor/stats code paths, primarily by bounding string handling and fixing off-by-one / bounds checks.
Changes:
- Add bounded helpers in
wifi_encoder.cto avoid unboundedstrlen()/string reads on fixed-size char arrays and harden ChannelAvailability string building. - Harden decoders/monitors with safer copies (
snprintf), index bounds checks, and corrected comparisons (>=vs>). - Adjust WiFi API radio subdoc decode initialization behavior.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| source/webconfig/wifi_webconfig_wifiapi_radio.c | Alters decoded-params initialization during wifiapi radio subdoc decode. |
| source/webconfig/wifi_encoder.c | Introduces bounded string helpers; tightens buffer building; adds NULL checks; updates multiple JSON string encodes. |
| source/webconfig/wifi_decoder.c | Avoids writing into cJSON-owned buffers, adds bounds checks, and replaces unsafe strcpy with snprintf in several decodes. |
| source/stats/wifi_stats_radio_temperature.c | Fixes radio index upper-bound check (>=). |
| source/stats/wifi_stats_radio_diagnostics.c | Fixes radio index upper-bound check (>=). |
| source/stats/wifi_stats_radio_channel.c | Fixes radio index upper-bound check (>=). |
| source/stats/wifi_stats_neighbor_report.c | Fixes radio index upper-bound check (>=). |
| source/stats/wifi_monitor.c | Adds index bounds check for stats enable array, fixes formatting/copy bounds, and corrects loop upper bound. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
vlad-safonov
reviewed
Jun 3, 2026
Reason for change: Fix memory issue identified through fuzz testing. Test Procedure: Debug Priority: P1 Risks: Low Signed-off-by: Atchaya Sivagnanam Atchaya_Sivagnanam@comcast.com
Comment on lines
+1367
to
1370
| for(UINT apIndex = 0; apIndex < getTotalNumberVAPs(); apIndex++) | ||
| { | ||
| UINT vap_index = VAP_INDEX(mgr->hal_cap, apIndex); | ||
| UINT radio = RADIO_INDEX(mgr->hal_cap, apIndex); |
This reverts commit ebc65e1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RDKB-64403 Fix memory issue found by libFuzzer
Reason for change: Fix memory issue identified through fuzz testing.
Test Procedure: Debug
Priority: P1
Risks: Low
Signed-off-by: Atchaya Sivagnanam Atchaya_Sivagnanam@comcast.com