[rdkdevpilot]

Automated Fix for Coverity Defects

Triggered by: GomathiShankar PS

Fixed Files

File	Line(s)	CIDs	Checker Types	Description
c_sourcecode/src/archive/archive.c	L265	68699	BUFFER_SIZE	Overlapping buffer in memory copy
c_sourcecode/src/utils/prerequisites.c	L72	68702	TAINTED_SCALAR	Untrusted value as argument
c_sourcecode/src/main.c	L248	68691	SIZEOF_MISMATCH	Wrong sizeof argument

Fix Summaries

c_sourcecode/src/archive/archive.c

The fix correctly replaces strcpy(tmp + 1, tmp + pattern_len) with memmove(tmp + 1, tmp + pattern_len, strlen(tmp + pattern_len) + 1). The original code used strcpy on overlapping memory regions (source tmp + pattern_len and destination tmp + 1 both point into the same buffer new_dump_name, with pattern_len = 5 meaning the source is 4 bytes ahead of the destination — clearly overlapping). strcpy has undefined behavior on overlapping buffers. memmove is the correct POSIX function for overlapping memory copies. The byte count strlen(tmp + pattern_len) + 1 correctly copies the tail of the string including the null terminator. The fix is minimal (single line change), does not introduce any new defects, preserves the existing loop logic, and directly addresses the Coverity BUFFER_SIZE / overlapping buffer defect.

c_sourcecode/src/utils/prerequisites.c

The fix correctly addresses the TAINTED_SCALAR defect by adding a uptime_val >= 0 guard to the condition on line 66. The value uptime_val is derived from fscanf reading an external file (/proc/uptime or /opt/uptime), making it tainted. Without the guard, a negative uptime_val (e.g., from a malformed file) would pass the < FOUR_EIGHTY_SECS check and cause sleep_time = FOUR_EIGHTY_SECS - uptime_val to produce a very large positive integer, potentially causing an extremely long sleep. The added uptime_val >= 0 check prevents this. The fix is minimal (one condition change), does not introduce new defects, preserves all existing logic and branches, and correctly validates the tainted scalar before use.

c_sourcecode/src/main.c

The fix correctly addresses the SIZEOF_MISMATCH defect by changing sizeof(archive) to sizeof(*archive). The original code used sizeof on the pointer variable 'archive' (which would be the size of a pointer, typically 4 or 8 bytes), while the corrected code uses sizeof(*archive) to get the size of the archive_info_t structure that the pointer points to. This ensures memset correctly zeroes out the entire allocated array of archive_info_t structures. The fix is minimal, correct, and does not introduce any new defects or break existing logic.

[Copilot]

🟢 Approval recommended

The three fixes are narrow and consistent with their intended behavior, with no unresolved findings.

No open issues 🎉

What changed in this PR

This PR addresses three Coverity defects in the crash-upload code with narrowly scoped fixes to memory copying, initialization, and upload-delay validation.

Changes:

• Use memmove for overlapping filename buffers.
• Reject negative uptime values before calculating the upload delay.
• Use the structure size when zeroing the archive array.

File	Description
c_sourcecode/​src/​utils/​prerequisites.c	Adds a nonnegative uptime guard before deferring uploads.
c_sourcecode/​src/​main.c	Corrects the element size used to initialize the archive array.
c_sourcecode/​src/​archive/​archive.c	Safely copies overlapping filename data, including the null terminator.

_{Review effort: Balanced}