From 0db823dbdfbfa6712946484016f8bcac9698d7d4 Mon Sep 17 00:00:00 2001
From: Kondamma12345 <Kondamma_Kudumula@comcast.com>
Date: Mon, 5 Oct 2026 11:14:56 +0000
Subject: [PATCH] RDKB-67212 Fixing Vulnerability issues WiFi API JSON file
 reads by validating file type and size before memory allocation and read.

---
 source/core/wifi_ctrl_wifiapi_handlers.c | 57 +++++++++++++++++-------
 1 file changed, 40 insertions(+), 17 deletions(-)

diff --git a/source/core/wifi_ctrl_wifiapi_handlers.c b/source/core/wifi_ctrl_wifiapi_handlers.c
index a2fde1c554..cfe6a6988d 100644
--- a/source/core/wifi_ctrl_wifiapi_handlers.c
+++ b/source/core/wifi_ctrl_wifiapi_handlers.c
@@ -687,7 +687,8 @@ void process_wifiapi_command(char *command, unsigned int len)
     wifi_mgr_t *mgr = (wifi_mgr_t *)get_wifimgr_obj();
     wifi_ctrl_t *ctrl = (wifi_ctrl_t *)get_wifictrl_obj();
     FILE *json_file;
-    long fsize;
+    struct stat st;
+    size_t bytes_read;
     char *raw = NULL;
     wifi_vap_info_map_t *vap_map;
     rdk_wifi_radio_t *radio;
@@ -753,23 +754,34 @@ void process_wifiapi_command(char *command, unsigned int len)
             snprintf(buff, sizeof(buff), "%s: failed to open file '%s'", args[0], args[2]);
             goto publish;
         }
-        fseek(json_file, 0, SEEK_END);
-        fsize = ftell(json_file);
-        fseek(json_file, 0, SEEK_SET);
-        if (fsize == 0) {
-            snprintf(buff, sizeof(buff), "%s: Invalid content size (0). file '%s'", args[0], args[2]);
+
+        if (fstat(fileno(json_file), &st) != 0 || !S_ISREG(st.st_mode)) {
+            snprintf(buff, sizeof(buff), "%s: invalid input file type '%s'", args[0], args[2]);
+            fclose(json_file);
+            goto publish;
+        }
+
+        if (st.st_size <= 0) {
+            snprintf(buff, sizeof(buff), "%s: invalid content size (%ld). file '%s'", args[0], (long)st.st_size, args[2]);
             fclose(json_file);
             goto publish;
         }
-        raw = malloc(fsize + 1);
+
+        raw = malloc((size_t)st.st_size + 1);
         if(raw == NULL) {
             snprintf(buff, sizeof(buff), "%s: failed to allocate memory", args[0]);
             fclose(json_file);
             goto publish;
         }
-        fread(raw, fsize, 1, json_file);
+        memset(raw, 0, (size_t)st.st_size + 1);
+
+        bytes_read = fread(raw,1, (size_t)st.st_size, json_file);
         fclose(json_file);
-        raw[fsize] = '\0';
+        if (bytes_read != (size_t)st.st_size) {
+            snprintf(buff, sizeof(buff), "%s: failed to read complete file '%s'", args[0], args[2]);
+            goto publish;
+        }
+        raw[bytes_read] = '\0';
 
         //webconfig decode
         config = &ctrl->webconfig;
@@ -832,23 +844,34 @@ void process_wifiapi_command(char *command, unsigned int len)
             snprintf(buff, sizeof(buff), "%s: failed to open file '%s'", args[0], args[2]);
             goto publish;
         }
-        fseek(json_file, 0, SEEK_END);
-        fsize = ftell(json_file);
-        fseek(json_file, 0, SEEK_SET);
-        if (fsize == 0) {
-            snprintf(buff, sizeof(buff), "%s: Invalid content size (0). file '%s'", args[0], args[2]);
+
+        if (fstat(fileno(json_file), &st) != 0 || !S_ISREG(st.st_mode)) {
+            snprintf(buff, sizeof(buff), "%s: invalid input file type '%s'", args[0], args[2]);
+            fclose(json_file);
+            goto publish;
+        }
+
+        if (st.st_size <= 0) {
+            snprintf(buff, sizeof(buff), "%s: invalid content size (%ld). file '%s'", args[0], (long)st.st_size, args[2]);
             fclose(json_file);
             goto publish;
         }
-        raw = malloc(fsize + 1);
+
+        raw = malloc((size_t)st.st_size + 1);
         if(raw == NULL) {
             snprintf(buff, sizeof(buff), "%s: failed to allocate memory", args[0]);
             fclose(json_file);
             goto publish;
         }
-        fread(raw, fsize, 1, json_file);
+        memset(raw, 0, (size_t)st.st_size + 1);
+
+        bytes_read = fread(raw, 1, (size_t)st.st_size, json_file);
         fclose(json_file);
-        raw[fsize] = '\0';
+        if (bytes_read != (size_t)st.st_size) {
+            snprintf(buff, sizeof(buff), "%s: failed to read complete file '%s'", args[0], args[2]);
+            goto publish;
+        }
+        raw[bytes_read] = '\0';
 
         //webconfig decode
         config = &ctrl->webconfig;