Skip to content

Fuzzing #1163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Atchaya-Sivagnanam wants to merge 8 commits into
base: develop
Choose a base branch
from
Open

Fuzzing #1163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
7c6dc1e
RDKB-64403 Fix memory issue found by libFuzzer
Atchaya-Sivagnanam May 27, 2026
0d34ad5
RDKB-64403 Fix memory issue found by libFuzzer
Atchaya-Sivagnanam May 27, 2026
1d580cd
Merge branch 'rdkcentral:develop' into fuzzing
Atchaya-Sivagnanam Jun 1, 2026
57978f3
Merge branch 'rdkcentral:develop' into fuzzing
Atchaya-Sivagnanam Jun 2, 2026
045986b
Merge branch 'rdkcentral:develop' into fuzzing
Atchaya-Sivagnanam Jun 3, 2026
fcb1a59
Merge branch 'rdkcentral:develop' into fuzzing
Atchaya-Sivagnanam Jun 4, 2026
ebc65e1
RDKB-64403 Fix memory issue found by libFuzzer
Atchaya-Sivagnanam Jun 4, 2026
e6fd79d
Revert "RDKB-64403 Fix memory issue found by libFuzzer"
Atchaya-Sivagnanam Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions source/stats/wifi_monitor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,9 @@ int get_vlan_from_vap_index(unsigned int vap_index, int *out_vlan)

BOOL IsWiFiApStatsEnable(UINT uvAPIndex)
{
if (uvAPIndex >= WIFI_INDEX_MAX) {
return FALSE;
}
return ((sWiFiDmlApStatsEnableCfg[uvAPIndex]) ? TRUE : FALSE);
}

Expand Down Expand Up @@ -1299,7 +1302,7 @@ BOOL client_fast_redeauth(unsigned int apIndex, char *mac)
static char*
macbytes_to_string(mac_address_t mac, unsigned char* string)
{
sprintf((char *)string, "%02x:%02x:%02x:%02x:%02x:%02x",
snprintf((char *)string, 18, "%02x:%02x:%02x:%02x:%02x:%02x",
mac[0] & 0xff,
mac[1] & 0xff,
mac[2] & 0xff,
Expand Down Expand Up @@ -1361,7 +1364,7 @@ static void
radio_stats_flag_changed(unsigned int radio_index, client_stats_enable_t *flag)
{
wifi_mgr_t *mgr = get_wifimgr_obj();
for(UINT apIndex = 0; apIndex <= getTotalNumberVAPs(); apIndex++)
for(UINT apIndex = 0; apIndex < getTotalNumberVAPs(); apIndex++)
{
UINT vap_index = VAP_INDEX(mgr->hal_cap, apIndex);
UINT radio = RADIO_INDEX(mgr->hal_cap, apIndex);
Comment on lines +1367 to 1370
Expand Down Expand Up @@ -2693,7 +2696,7 @@ int csi_getClientIpAddress(char *mac, char *ip, char *interface, int check)
struct rtattr * table[NDA_MAX+1];
int fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
char if_name[IFNAMSIZ] = {'\0'};
unsigned char tmp_mac[17];
unsigned char tmp_mac[18];
unsigned char af_family;

if(mac == NULL || ip == NULL || interface == NULL) {
Expand Down
2 changes: 1 addition & 1 deletion source/stats/wifi_stats_neighbor_report.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ int validate_neighbor_ap_args(wifi_mon_stats_args_t *args)
return RETURN_ERR;
}

if (args->radio_index > getNumberRadios()) {
if (args->radio_index >= getNumberRadios()) {
wifi_util_error_print(WIFI_MON, "%s:%d invalid radio index : %d\n",__func__,__LINE__, args->radio_index);
return RETURN_ERR;
}
Expand Down
2 changes: 1 addition & 1 deletion source/stats/wifi_stats_radio_channel.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ int validate_radio_channel_args(wifi_mon_stats_args_t *args)
return RETURN_ERR;
}

if (args->radio_index > getNumberRadios()) {
if (args->radio_index >= getNumberRadios()) {
wifi_util_error_print(WIFI_MON, "%s:%d invalid radio index : %d\n",__func__,__LINE__, args->radio_index);
return RETURN_ERR;
}
Expand Down
2 changes: 1 addition & 1 deletion source/stats/wifi_stats_radio_diagnostics.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ int validate_radio_diagnostic_args(wifi_mon_stats_args_t *args)
return RETURN_ERR;
}

if (args->radio_index > getNumberRadios()) {
if (args->radio_index >= getNumberRadios()) {
wifi_util_error_print(WIFI_MON, "%s:%d invalid radio index : %d\n",__func__,__LINE__, args->radio_index);
return RETURN_ERR;
}
Expand Down
2 changes: 1 addition & 1 deletion source/stats/wifi_stats_radio_temperature.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ int validate_radio_temperature_args(wifi_mon_stats_args_t *args)
return RETURN_ERR;
}

if (args->radio_index > getNumberRadios()) {
if (args->radio_index >= getNumberRadios()) {
wifi_util_error_print(WIFI_MON, "%s:%d invalid radio index : %d\n",__func__,__LINE__, args->radio_index);
return RETURN_ERR;
}
Expand Down
48 changes: 27 additions & 21 deletions source/webconfig/wifi_decoder.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -989,13 +989,14 @@ webconfig_error_t decode_radius_object(const cJSON *radius, wifi_radius_settings
const cJSON *param;

decode_param_allow_empty_string(radius, "RadiusServerIPAddr", param);
if (strlen(param->valuestring) == 0) {
const char *radius_ip_val = param->valuestring;
if (strlen(radius_ip_val) == 0) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: RadiusServerIPAddr is NULL\n", __func__, __LINE__);
strcpy(param->valuestring,"0.0.0.0");
radius_ip_val = "0.0.0.0";
}
if (decode_ipv4_address(param->valuestring) == webconfig_error_none || decode_ipv6_address(param->valuestring) == webconfig_error_none) {
if (decode_ipv4_address((char *)radius_ip_val) == webconfig_error_none || decode_ipv6_address((char *)radius_ip_val) == webconfig_error_none) {
#ifndef WIFI_HAL_VERSION_3_PHASE2
strncpy((char *)radius_info->ip,param->valuestring,sizeof(radius_info->ip)-1);
strncpy((char *)radius_info->ip,radius_ip_val,sizeof(radius_info->ip)-1);
Comment thread
Atchaya-Sivagnanam marked this conversation as resolved.
}
Comment thread
Atchaya-Sivagnanam marked this conversation as resolved.
else {
wifi_util_error_print(WIFI_WEBCONFIG,"%s:%d: Validation failed for RadiusServerIPAddr\n", __func__, __LINE__);
Expand All @@ -1004,9 +1005,9 @@ webconfig_error_t decode_radius_object(const cJSON *radius, wifi_radius_settings
}
#else
/* check the INET family and update the radius ip address */
if(inet_pton(AF_INET, param->valuestring, &(radius_info->ip.u.IPv4addr)) > 0) {
if(inet_pton(AF_INET, radius_ip_val, &(radius_info->ip.u.IPv4addr)) > 0) {
radius_info->ip.family = wifi_ip_family_ipv4;
} else if(inet_pton(AF_INET6, param->valuestring, &(radius_info->ip.u.IPv6addr)) > 0) {
} else if(inet_pton(AF_INET6, radius_ip_val, &(radius_info->ip.u.IPv6addr)) > 0) {
radius_info->ip.family = wifi_ip_family_ipv6;
} else {
return webconfig_error_decode;
Expand All @@ -1019,13 +1020,14 @@ webconfig_error_t decode_radius_object(const cJSON *radius, wifi_radius_settings
snprintf(radius_info->key, sizeof(radius_info->key), "%s", param->valuestring);

decode_param_allow_empty_string(radius, "SecondaryRadiusServerIPAddr", param);
if (strlen(param->valuestring) == 0) {
const char *secondary_ip_val = param->valuestring;
if (strlen(secondary_ip_val) == 0) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: SecondaryRadiusServerIPAddr is NULL\n", __func__, __LINE__);
strcpy(param->valuestring,"0.0.0.0");
secondary_ip_val = "0.0.0.0";
}
if (decode_ipv4_address(param->valuestring) == webconfig_error_none || decode_ipv6_address(param->valuestring) == webconfig_error_none) {
if (decode_ipv4_address((char *)secondary_ip_val) == webconfig_error_none || decode_ipv6_address((char *)secondary_ip_val) == webconfig_error_none) {
#ifndef WIFI_HAL_VERSION_3_PHASE2
strncpy((char *)radius_info->s_ip,param->valuestring,sizeof(radius_info->s_ip)-1);
strncpy((char *)radius_info->s_ip,secondary_ip_val,sizeof(radius_info->s_ip)-1);
}
Comment thread
Atchaya-Sivagnanam marked this conversation as resolved.
else {
wifi_util_error_print(WIFI_WEBCONFIG,"%s:%d: Validation failed for SecondaryRadiusServerIPAddr\n", __func__, __LINE__);
Expand All @@ -1034,9 +1036,9 @@ webconfig_error_t decode_radius_object(const cJSON *radius, wifi_radius_settings
}
#else
/* check the INET family and update the radius ip address */
if (inet_pton(AF_INET, param->valuestring, &(radius_info->s_ip.u.IPv4addr)) > 0) {
if (inet_pton(AF_INET, secondary_ip_val, &(radius_info->s_ip.u.IPv4addr)) > 0) {
radius_info->s_ip.family = wifi_ip_family_ipv4;
} else if(inet_pton(AF_INET6, param->valuestring, &(radius_info->s_ip.u.IPv6addr)) > 0) {
} else if(inet_pton(AF_INET6, secondary_ip_val, &(radius_info->s_ip.u.IPv6addr)) > 0) {
radius_info->s_ip.family = wifi_ip_family_ipv6;
} else {
return webconfig_error_decode;
Expand All @@ -1049,13 +1051,14 @@ webconfig_error_t decode_radius_object(const cJSON *radius, wifi_radius_settings
snprintf(radius_info->s_key, sizeof(radius_info->s_key), "%s", param->valuestring);

decode_param_allow_empty_string(radius, "DasServerIPAddr", param);
if (strlen(param->valuestring) == 0) {
const char *das_ip_val = param->valuestring;
if (strlen(das_ip_val) == 0) {
wifi_util_dbg_print(WIFI_WEBCONFIG,"%s:%d: DasServerIPAddr is NULL\n", __func__, __LINE__);
strcpy(param->valuestring,"0.0.0.0");
das_ip_val = "0.0.0.0";
}
if (inet_pton(AF_INET, param->valuestring, &(radius_info->dasip.u.IPv4addr)) > 0) {
if (inet_pton(AF_INET, das_ip_val, &(radius_info->dasip.u.IPv4addr)) > 0) {
radius_info->dasip.family = wifi_ip_family_ipv4;
} else if (inet_pton(AF_INET6, param->valuestring, &(radius_info->dasip.u.IPv6addr)) > 0) {
} else if (inet_pton(AF_INET6, das_ip_val, &(radius_info->dasip.u.IPv6addr)) > 0) {
radius_info->dasip.family = wifi_ip_family_ipv6;
} else {
wifi_util_error_print(WIFI_WEBCONFIG,"%s:%d: Validation failed for DasServerIPAddr\n", __func__, __LINE__);
Expand Down Expand Up @@ -2909,6 +2912,9 @@ void decode_acs_keep_out_json(const char *json_string, unsigned int num_of_radio
if (convert_freq_band_to_radio_index(freq_band, &radioIndex) != RETURN_OK) {
continue;
}
if (radioIndex < 0 || (unsigned int)radioIndex >= num_of_radios) {
continue;
}
radio_oper = &data->u.decoded.radios[radioIndex].oper;
if (!radio_oper) {
wifi_util_error_print(WIFI_CTRL,
Expand Down Expand Up @@ -3383,16 +3389,16 @@ webconfig_error_t decode_device_info(const cJSON *device_cfg, wifi_platform_prop
const cJSON *param;

decode_param_string(device_cfg, "Manufacturer", param);
strcpy(info->manufacturer, param->valuestring);
snprintf(info->manufacturer, sizeof(info->manufacturer), "%s", param->valuestring);

decode_param_string(device_cfg, "Model", param);
strcpy(info->manufacturerModel, param->valuestring);
snprintf(info->manufacturerModel, sizeof(info->manufacturerModel), "%s", param->valuestring);

decode_param_string(device_cfg, "SerialNo", param);
strcpy(info->serialNo, param->valuestring);
snprintf(info->serialNo, sizeof(info->serialNo), "%s", param->valuestring);

decode_param_string(device_cfg, "Software_version", param);
strcpy(info->software_version, param->valuestring);
snprintf(info->software_version, sizeof(info->software_version), "%s", param->valuestring);

decode_param_string(device_cfg, "CMMAC", param);
str_to_mac_bytes(param->valuestring,info->cm_mac);
Expand Down Expand Up @@ -4597,7 +4603,7 @@ webconfig_error_t decode_harvester_object(const cJSON *obj, instant_measurement_
decode_param_bool(obj, "Enabled", param);
harvester->b_inst_client_enabled = (param->type & cJSON_True) ? true:false;
decode_param_string(obj, "MacAddress", param);
strcpy(harvester->mac_address, param->valuestring);
snprintf(harvester->mac_address, sizeof(harvester->mac_address), "%s", param->valuestring);
decode_param_integer(obj, "ReportingPeriod", param);
harvester->u_inst_client_reporting_period = param->valuedouble;
decode_param_integer(obj, "DefReportingPeriod", param);
Expand Down
Loading
Loading