RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus #236

yogeswaransky · 2026-01-07T05:55:16Z

No description provided.

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

source/ccspinterface/rbusInterface.c

+        header->component_name[sizeof(header->component_name) - 1] = '\0';
+
+        // Copy marker data
+        memcpy(message + sizeof(T2MQMessageHeader), marker_list, strlen(marker_list));


source/ccspinterface/rbusInterface.c

+            header->component_name[sizeof(header->component_name) - 1] = '\0';
+
+            // Copy marker data
+            memcpy(message + sizeof(T2MQMessageHeader), marker_list, strlen(marker_list));


source/ccspinterface/rbusInterface.c

+            T2Info("T2_MQ_MSG_SUBSCRIBE\n");
+            if (header->data_length > 0)
+            {
+                char* component_name = message + sizeof(T2MQMessageHeader);


source/ccspinterface/rbusInterface.c

+            // Handle event data from client
+            if (header->data_length > 0)
+            {
+                char* event_data = message + sizeof(T2MQMessageHeader);


source/commonlib/t2_transport_interface.c

+    FILE *logHandle = NULL ;
+
+    pthread_mutex_lock(&loggerMutex);
+    logHandle = fopen(SENDER_LOG_FILE, "a+");


To fix the problem, the file must be created (or adjusted) with restrictive permissions, typically read/write for the owner only (0600). The cleanest, portable approach here—without altering behavior except for permissions—is to ensure that whenever the log file is newly created, its permissions are restricted. Because fopen doesn’t allow us to specify permissions directly, we can first open the file with O_CREAT and mode S_IRUSR | S_IWUSR, then immediately close it and proceed with fopen as before. This keeps the use of FILE * and buffered I/O unchanged while guaranteeing safe permissions at creation time.

Concretely, in EVENT_DEBUG in source/commonlib/t2_transport_interface.c, just before calling fopen(SENDER_LOG_FILE, "a+"), add a small block that does:

int fd = open(SENDER_LOG_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);

Check for fd >= 0 and close it immediately.

Ignore EEXIST semantics since we only care about creation; if the file already exists, open won’t change its mode, but that is acceptable for this minimal change (we avoid altering permissions of an existing file to prevent surprising behavior).

<sys/stat.h> and <fcntl.h> are already included at the top of the file, so no new imports are required. The logic and behavior of logging remain the same, except that a missing log file will now be created with permissions 0600 rather than being dependent on umask.

source/commonlib/t2_transport_interface.c

+        return NULL;
+    }
+
+    FILE *fp = fopen(T2_CACHE_FILE, "a");


In general, to avoid creating world‑writable files, do not rely on fopen’s default creation behavior. Instead, create the file using open with an explicit permission mask such as S_IRUSR | S_IWUSR (read/write for owner only), and then, if a FILE * is needed, wrap the resulting file descriptor with fdopen. This ensures that when the file is first created, it receives restrictive permissions independent of the process’ umask.

For this specific code, the best fix is to replace fopen(T2_CACHE_FILE, "a") with a two‑step sequence: call open(T2_CACHE_FILE, O_WRONLY | O_CREAT | O_APPEND, S_IRUSR | S_IWUSR) to either open or create the cache file safely, then call fdopen on the obtained descriptor with mode "a" to maintain the same append semantics that fopen would have provided. We should handle error cases carefully: if open fails, log and jump to the existing unlock label; if fdopen fails, close the descriptor, log, and go to unlock. This change is confined to the area around line 794 and uses existing headers (<fcntl.h>, <sys/stat.h>) that are already included at the top of the file, so no new imports are required and no external behavior changes occur other than more restrictive permissions on first creation.

source/commonlib/t2_transport_interface.c

+
+            if (is_for_us && header->data_length > 0)
+            {
+                char* marker_data = message + sizeof(T2MQMessageHeader);


source/commonlib/t2_transport_interface.c

+            EVENT_ERROR("Message too large: %zu bytes\n", sizeof(T2MQMessageHeader) + data_len);
+            return T2ERROR_FAILURE;
+        }
+        memcpy(message + sizeof(T2MQMessageHeader), data, data_len);


Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins · 2026-01-07T15:19:26Z

source/ccspinterface/rbusInterface.c

+        T2Info("No markers found for component: %s\n", query_component);
+        strcpy(marker_response, ""); // Empty response
+    }
+    return strdup(marker_response);


Coverity Issue - Resource leak

Variable "eventMarkerList" going out of scope leaks the storage it points to.

High Impact, CWE-404
RESOURCE_LEAK

rdkcmf-jenkins · 2026-01-07T15:19:26Z

source/ccspinterface/rbusInterface.c

+    {
+        T2Error("Failed to send marker response header to client %d\n", client_index);
+        t2_cleanup_tcp_client(client_index);
+        return;


Coverity issue no longer present as of: undefined

Show issue

Coverity Issue - Resource leak

Variable "eventMarkerList" going out of scope leaks the storage it points to.

High Impact, CWE-404
RESOURCE_LEAK

rdkcmf-jenkins · 2026-01-07T15:19:26Z

source/ccspinterface/rbusInterface.c

+           client_index, component_name);
+
+    T2Debug("%s --out\n", __FUNCTION__);
+}


Coverity issue no longer present as of: undefined

Show issue

Coverity Issue - Resource leak

Variable "eventMarkerList" going out of scope leaks the storage it points to.

High Impact, CWE-404
RESOURCE_LEAK

rdkcmf-jenkins · 2026-01-07T15:19:26Z

source/commonlib/telemetry_busmessage_sender.c

+    {
+        pthread_mutex_lock(&clientMarkerMutex);
+        hash_map_destroy(clientEventMarkerMap, free);
+        clientEventMarkerMap = NULL;


Coverity Issue - Check of thread-shared field evades lock acquisition

Thread1 sets "clientEventMarkerMap" to a new value. Now the two threads have an inconsistent view of "clientEventMarkerMap" and updates to fields of "clientEventMarkerMap" or fields correlated with "clientEventMarkerMap" may be lost.

High Impact, CWE-543
LOCK_EVASION

How to fix

Guard the modification of "clientEventMarkerMap" and the read used to decide whether to modify "clientEventMarkerMap" with the same set of locks.

rdkcmf-jenkins · 2026-01-07T15:19:26Z

source/commonlib/t2_transport_interface.c

+    char* marker_data = NULL;
+    if (resp_header.data_length > 0)
+    {
+        marker_data = malloc(resp_header.data_length + 1);


Coverity Issue - Untrusted allocation size

Passing tainted expression "resp_header.data_length + 1U" to "malloc", which uses it as an allocation size.

Medium Impact, CWE-789
TAINTED_SCALAR

How to fix

Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.

rdkcmf-jenkins · 2026-01-07T15:19:27Z

source/commonlib/t2_transport_interface.c

+
+    struct timeval timeout = {.tv_sec = 10, .tv_usec = 0};
+    setsockopt(g_tcp_client_fd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
+    setsockopt(g_tcp_client_fd, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));


Coverity Issue - Unchecked return value from library

Calling "setsockopt(g_tcp_client_fd, 1, 21, &timeout, 16U)" without checking return value. This library function may fail and return an error code.

Medium Impact, CWE-252
CHECKED_RETURN

rdkcmf-jenkins · 2026-01-07T15:19:27Z

source/ccspinterface/rbusInterface.c

+        header->component_name[sizeof(header->component_name) - 1] = '\0';
+
+        // Copy marker data
+        memcpy(message + sizeof(T2MQMessageHeader), marker_list, strlen(marker_list));


Coverity Issue - Copy into fixed size buffer

You might overrun the 4096-character fixed-size string "message + 152UL" by copying "marker_list" without checking the length.

Low Impact, CWE-120
STRING_OVERFLOW

rdkcmf-jenkins · 2026-01-07T15:19:27Z

source/ccspinterface/rbusInterface.c

+            header->component_name[sizeof(header->component_name) - 1] = '\0';
+
+            // Copy marker data
+            memcpy(message + sizeof(T2MQMessageHeader), marker_list, strlen(marker_list));


Coverity Issue - Copy into fixed size buffer

You might overrun the 4096-character fixed-size string "message + 152UL" by copying "marker_list" without checking the length.

Low Impact, CWE-120
STRING_OVERFLOW

rdkcmf-jenkins · 2026-01-07T15:19:27Z

source/ccspinterface/rbusInterface.c

+        break;
+
+    case T2_MSG_EVENT_DATA:
+        t2_handle_event_data(client_index, &req_header);


Coverity issue no longer present as of: undefined

Show issue

Coverity Issue - Untrusted allocation size

Passing tainted expression "req_header.data_length" to "t2_handle_event_data", which uses it as an allocation size.

Medium Impact, CWE-789
TAINTED_SCALAR

How to fix

Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.

rdkcmf-jenkins · 2026-01-07T15:19:27Z

source/commonlib/t2_transport_interface.c

+ */
+static void t2_mq_check_marker_updates(void)
+{
+    if (!g_mq_state.initialized || g_mq_state.broadcast_mq == -1)


Coverity issue no longer present as of: undefined

Show issue

Coverity Issue - Data race condition

Accessing "g_mq_state.broadcast_mq" without holding lock "g_mq_mutex". Elsewhere, "g_mq_state.broadcast_mq" is written to with "g_mq_mutex" held 2 out of 2 times.

Medium Impact, CWE-366
MISSING_LOCK

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins · 2026-01-11T18:56:21Z

source/commonlib/t2_transport_interface.c

+    sev.sigev_signo = SIGUSR1;
+    sev.sigev_value.sival_ptr = NULL;
+
+    if (mq_notify(g_mq_state.broadcast_mq, &sev) == -1) {


Coverity Issue - Uninitialized scalar variable

Using uninitialized value "sev". Field "sev._sigev_un" is uninitialized when calling "mq_notify".

High Impact, CWE-457
UNINIT

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins · 2026-01-11T21:29:20Z

source/ccspinterface/rbusInterface.c

+    sev.sigev_signo = SIGUSR1;
+    sev.sigev_value.sival_ptr = &g_daemon_mq_state;
+
+    if (mq_notify(g_daemon_mq_state.daemon_mq, &sev) == -1)


Coverity Issue - Data race condition

Accessing "g_daemon_mq_state.daemon_mq" without holding lock "g_daemon_mq_mutex". Elsewhere, "g_daemon_mq_state.daemon_mq" is written to with "g_daemon_mq_mutex" held 2 out of 2 times.

Medium Impact, CWE-366
MISSING_LOCK

rdkcmf-jenkins · 2026-01-11T21:29:20Z

source/ccspinterface/rbusInterface.c

+    char message[T2_MQ_MAX_MSG_SIZE];
+    ssize_t msg_size;
+
+    if (!g_daemon_mq_state.initialized || g_daemon_mq_state.daemon_mq == -1)


Coverity Issue - Data race condition

Accessing "g_daemon_mq_state.daemon_mq" without holding lock "g_daemon_mq_mutex". Elsewhere, "g_daemon_mq_state.daemon_mq" is written to with "g_daemon_mq_mutex" held 2 out of 2 times.

Medium Impact, CWE-366
MISSING_LOCK

rdkcmf-jenkins · 2026-01-11T21:29:20Z

source/ccspinterface/rbusInterface.c

+    sev.sigev_signo = SIGUSR1;
+    sev.sigev_value.sival_ptr = &g_daemon_mq_state;
+
+    if (mq_notify(g_daemon_mq_state.daemon_mq, &sev) == -1)


Coverity Issue - Uninitialized scalar variable

Using uninitialized value "sev". Field "sev._sigev_un" is uninitialized when calling "mq_notify".

High Impact, CWE-457
UNINIT

Yogeswaran K added 4 commits December 29, 2025 07:11

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

ec7dddb

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

5c5820c

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

a69053e

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

1988057

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

yogeswaransky requested a review from a team as a code owner January 7, 2026 05:55

github-advanced-security bot found potential problems Jan 7, 2026

View reviewed changes

Yogeswaran K added 2 commits January 7, 2026 10:48

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

f361d93

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

fef8936

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins reviewed Jan 7, 2026

View reviewed changes

Yogeswaran K added 6 commits January 9, 2026 14:15

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

e72c692

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

aad0d00

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

4ed6fa0

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

10c4200

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

45d4248

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

cd0f619

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins reviewed Jan 11, 2026

View reviewed changes

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus

3f35408

Signed-off-by: Yogeswaran K <yogeswaran_k@comcast.com>

rdkcmf-jenkins reviewed Jan 11, 2026

View reviewed changes

@@ -175,6 +175,12 @@
                 FILE *logHandle = NULL ;
                 pthread_mutex_lock(&loggerMutex);
+                /* Ensure the log file is created with restrictive permissions (owner read/write only) */
+                int fd = open(SENDER_LOG_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+                if (fd >= 0)
+                {
+                    close(fd);
+                }
                 logHandle = fopen(SENDER_LOG_FILE, "a+");
                 if(logHandle)
                 {

@@ -791,12 +791,21 @@
                     return NULL;
                 }
-                FILE *fp = fopen(T2_CACHE_FILE, "a");
-                if (fp == NULL)
+                int cache_fd = open(T2_CACHE_FILE, O_WRONLY | O_CREAT | O_APPEND, S_IRUSR | S_IWUSR);
+                if (cache_fd == -1)
                 {
                     EVENT_ERROR("%s: File open error %s\n", __FUNCTION__, T2_CACHE_FILE);
                     goto unlock;
                 }
+                FILE *fp = fdopen(cache_fd, "a");
+                if (fp == NULL)
+                {
+                    EVENT_ERROR("%s: fdopen error %s\n", __FUNCTION__, T2_CACHE_FILE);
+                    close(cache_fd);
+                    goto unlock;
+                }
                 fs = popen ("cat /tmp/t2_caching_file | wc -l", "r");
                 if(fs != NULL)
                 {

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus #236

Are you sure you want to change the base?

RDK-60001: [SPIKE] Decouple T2 Common Library From Rbus #236

Uh oh!

Conversation

yogeswaransky commented Jan 7, 2026

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Resource leak

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Resource leak

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Resource leak

Uh oh!

rdkcmf-jenkins Jan 7, 2026

Choose a reason for hiding this comment

Coverity Issue - Check of thread-shared field evades lock acquisition

How to fix

Uh oh!

rdkcmf-jenkins Jan 7, 2026

Choose a reason for hiding this comment

Coverity Issue - Untrusted allocation size

How to fix

Uh oh!

rdkcmf-jenkins Jan 7, 2026

Choose a reason for hiding this comment

Coverity Issue - Unchecked return value from library

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Copy into fixed size buffer

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Copy into fixed size buffer

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Untrusted allocation size

How to fix

Uh oh!

rdkcmf-jenkins Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Coverity Issue - Data race condition

Uh oh!

rdkcmf-jenkins Jan 11, 2026

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading

rdkcmf-jenkins Jan 7, 2026 •

edited

Loading