RDKB-66750: Mythos Defect Remediation

source/bulkdata/reportprofiles.c

@@ -30,6 +30,7 @@
 #include <sys/resource.h>
 #include <fcntl.h>
 #include <sys/stat.h>
+#include <errno.h>
 #include "reportprofiles.h"
 
 #include "xconfclient.h"
@@ -50,6 +51,7 @@
 #include "t2parser.h"
 #include "telemetry2_0.h"
 #include "t2MtlsUtils.h"
+#include "t2common.h"
 #include "persistence.h"
 #ifdef LIBRDKCERTSEL_BUILD
 #include "curlinterface.h"
@@ -622,8 +624,14 @@ T2ERROR initReportProfiles()
                 check_component_crash(TELEMETRY_INIT_FILE_BOOTUP);
 
                 //Touching TELEMETRY_INIT_FILE_BOOTUP during Bootup
-                system("touch /tmp/telemetry_initialized_bootup");
-                T2Debug(" %s Touched \n", TELEMETRY_INIT_FILE_BOOTUP);
+                if (!createSecureTempFlag(TELEMETRY_INIT_FILE_BOOTUP))
+                {
+                    T2Error("Failed to create secure boot flag %s\n", TELEMETRY_INIT_FILE_BOOTUP);
+                }
+                else
+                {
+                    T2Debug(" %s Touched \n", TELEMETRY_INIT_FILE_BOOTUP);
+                }
             }
 #endif
             //Web Config Framework init ends
@@ -642,11 +650,9 @@ T2ERROR initReportProfiles()
         {
             unregisterDEforCompEventList();
             createComponentDataElements();
-            FILE* cfgReadyFlag = NULL ;
-            cfgReadyFlag = fopen(T2_CONFIG_READY, "w+");
-            if(cfgReadyFlag)
+            if (!createSecureTempFlag(T2_CONFIG_READY))
             {
-                fclose(cfgReadyFlag);
+                T2Error("Failed to create secure config ready flag %s\n", T2_CONFIG_READY);
             }
             setT2EventReceiveState(T2_STATE_CONFIG_READY);
             T2Info("T2 is now Ready to be configured for report profiles\n");
@@ -658,16 +664,13 @@ T2ERROR initReportProfiles()
 
 
     // This indicates telemetry has started
-    FILE* bootFlag = NULL ;
-    bootFlag = fopen(BOOTFLAG, "w+");
-    if(bootFlag)
+    if (!createSecureTempFlag(BOOTFLAG))
     {
-        T2Debug("%s Touched \n", BOOTFLAG);
-        fclose(bootFlag);
+        T2Error("Failed to create secure T2 bootflag %s \n", BOOTFLAG);
     }
     else
     {
-        T2Error("Failed to create T2 bootflag %s \n", BOOTFLAG);
+        T2Debug("%s Touched \n", BOOTFLAG);
     }
 
     T2Debug("%s --out\n", __FUNCTION__);
@@ -932,6 +935,12 @@ void ReportProfiles_ProcessReportProfilesBlob(cJSON *profiles_root, bool rprofil
         }
 
         cJSON* nameObj = cJSON_GetObjectItem(singleProfile, "name");
+        if (!cJSON_IsString(nameObj) || !nameObj->valuestring || !nameObj->valuestring[0] ||
+                strspn(nameObj->valuestring, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-") != strlen(nameObj->valuestring))
+        {
+            T2Error("Invalid profile name in JSON configuration\n");
+            continue;
+        }
         cJSON* hashObj = cJSON_GetObjectItem(singleProfile, "hash");
         if(hashObj == NULL)
         {
@@ -946,7 +955,18 @@ void ReportProfiles_ProcessReportProfilesBlob(cJSON *profiles_root, bool rprofil
         }
 
         ReportProfile *profileEntry = (ReportProfile *)malloc(sizeof(ReportProfile));
+        if (profileEntry == NULL)
+        {
+            T2Error("Failed to allocate report profile entry\n");
+            continue;
+        }
         profileName = strdup(nameObj->valuestring);
+        if (profileName == NULL)
+        {
+            T2Error("Failed to copy profile name from JSON configuration\n");
+            free(profileEntry);
+            continue;
+        }
         profileEntry->hash = strdup(hashObj->valuestring);
         profileEntry->config = cJSON_PrintUnformatted(profileObj);
         hash_map_put(receivedProfileHashMap, profileName, profileEntry, freeReportProfileHashMap);
@@ -1400,6 +1420,29 @@ int __ReportProfiles_ProcessReportProfilesMsgPackBlob(void *msgpack, bool checkP
             continue;
         }
         msgpack_object* nameObj = msgpack_get_map_value(singleProfile, "name");
+        size_t nameIndex;
+        if (nameObj == NULL || nameObj->type != MSGPACK_OBJECT_STR ||
+                nameObj->via.str.ptr == NULL || nameObj->via.str.size == 0)
+        {
+            T2Error("Invalid profile name in MsgPack configuration\n");
+            continue;
+        }
+        for (nameIndex = 0; nameIndex < nameObj->via.str.size; nameIndex++)
+        {
+            unsigned char character = (unsigned char)nameObj->via.str.ptr[nameIndex];
+            if (!((character >= 'a' && character <= 'z') ||
+                    (character >= 'A' && character <= 'Z') ||
+                    (character >= '0' && character <= '9') ||
+                    character == '_' || character == '-'))
+            {
+                T2Error("Invalid profile name in MsgPack configuration\n");
+                break;
+            }
+        }
+        if (nameIndex != nameObj->via.str.size)
+        {
+            continue;
+        }
         msgpack_object* hashObj = msgpack_get_map_value(singleProfile, "hash");
         if (hashObj == NULL)
         {
@@ -1417,6 +1460,11 @@ int __ReportProfiles_ProcessReportProfilesMsgPackBlob(void *msgpack, bool checkP
         char *existingProfileHash = NULL;
         Profile *profile = NULL;
         profileName = msgpack_strdup(nameObj);
+        if (profileName == NULL)
+        {
+            T2Error("Failed to copy profile name from MsgPack configuration\n");
+            continue;
+        }
         existingProfileHash = hash_map_remove(profileHashMap, profileName);
         if(NULL == existingProfileHash)
         {

source/bulkdata/t2eventreceiver.c

@@ -19,9 +19,14 @@
 
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <errno.h>
 
 #include "t2eventreceiver.h"
 
+#include "t2common.h"
 #include "t2collection.h"
 #include "t2markers.h"
 #include "telemetry2_0.h"
@@ -32,6 +37,8 @@
 
 #define T2EVENTQUEUE_MAX_LIMIT 200
 #define MESSAGE_DELIMITER "<#=#>"
+#define MAX_EVENT_NAME_LEN 256
+#define MAX_EVENT_VALUE_LEN 4096
 
 static queue_t *eQueue = NULL;
 static bool EREnabled = false;
@@ -80,6 +87,24 @@ static char *strSplit(char *str, char *delim)
     return ret;
 }
 
+static bool isValidEventLength(const char *name, const char *value)
+{
+    if(name == NULL || value == NULL)
+    {
+        return false;
+    }
+
+    size_t nameLen = strlen(name);
+    size_t valueLen = strlen(value);
+    if(nameLen == 0 || nameLen > MAX_EVENT_NAME_LEN || valueLen > MAX_EVENT_VALUE_LEN)
+    {
+        T2Warning("Dropping oversized telemetry event: nameLen=%zu valueLen=%zu\n", nameLen, valueLen);
+        return false;
+    }
+
+    return true;
+}
+
 void freeT2Event(void *data)
 {
     if(data != NULL)
@@ -114,51 +139,59 @@ void T2ER_PushDataWithDelim(char* eventInfo, char* user_data)
             char* token = strSplit(eventInfo, MESSAGE_DELIMITER);
             if(token != NULL)
             {
-                T2Event *event = (T2Event *) malloc(sizeof(T2Event));
-                if(event)
+                char* valueToken = strSplit(NULL, MESSAGE_DELIMITER);
+                if(valueToken != NULL)
                 {
-                    event->name = strdup(token);
-                    token = strSplit(NULL, MESSAGE_DELIMITER);
-                    if(token != NULL)
+                    if(!isValidEventLength(token, valueToken))
                     {
-                        event->value = strdup(token);
-                        if(t2_queue_count(eQueue) > T2EVENTQUEUE_MAX_LIMIT)
-                        {
-                            T2Warning("T2EventQueue max limit : %d reached, dropping packet for  eventName : %s eventValue : %s\n",
-                                      T2EVENTQUEUE_MAX_LIMIT, event->name, event->value);
-                            free(event->value);
-                            free(event->name);
-                            free(event);
-                        }
-                        else
+                        T2Warning("Dropping event with invalid length for eventName : %s eventValue : %s\n", token, valueToken);
+                    }
+                    else if(t2_queue_count(eQueue) > T2EVENTQUEUE_MAX_LIMIT)
+                    {
+                        T2Warning("T2EventQueue max limit : %d reached, dropping packet for eventName : %s eventValue : %s\n",
+                                  T2EVENTQUEUE_MAX_LIMIT, token, valueToken);
+                    }
+                    else
+                    {
+                        T2Event *event = (T2Event *) malloc(sizeof(T2Event));
+                        if(event != NULL)
                         {
-                            T2Debug("Adding eventName : %s eventValue : %s to t2event queue\n", event->name, event->value);
-                            t2_queue_push(eQueue, (void *) event);
-                            // Check stopDispatchThread with proper lock to avoid stale reads from compiler
-                            // optimizations or CPU caching. We hold sTDMutex while reading stopDispatchThread
-                            // to ensure proper synchronization with the thread that sets this flag.
-                            if(pthread_mutex_lock(&sTDMutex) == 0)
+                            event->name = strdup(token);
+                            event->value = strdup(valueToken);
+                            if(event->name != NULL && event->value != NULL)
                             {
-                                bool shouldSignal = !stopDispatchThread;
-                                pthread_mutex_unlock(&sTDMutex);
-                                if(shouldSignal)
+                                T2Debug("Adding eventName : %s eventValue : %s to t2event queue\n", event->name, event->value);
+                                t2_queue_push(eQueue, (void *) event);
+                                // Check stopDispatchThread with proper lock to avoid stale reads from compiler
+                                // optimizations or CPU caching. We hold sTDMutex while reading stopDispatchThread
+                                // to ensure proper synchronization with the thread that sets this flag.
+                                if(pthread_mutex_lock(&sTDMutex) == 0)
                                 {
-                                    ret = pthread_cond_signal(&erCond);
-                                    if(ret != 0) // pthread cond signal failed so return after unlocking the mutex
+                                    bool shouldSignal = !stopDispatchThread;
+                                    pthread_mutex_unlock(&sTDMutex);
+                                    if(shouldSignal)
                                     {
-                                        T2Error("%s pthread_cond_signal for erCond failed with error code : %d\n", __FUNCTION__, ret);
+                                        ret = pthread_cond_signal(&erCond);
+                                        if(ret != 0) // pthread cond signal failed so return after unlocking the mutex
+                                        {
+                                            T2Error("%s pthread_cond_signal for erCond failed with error code : %d\n", __FUNCTION__, ret);
+                                        }
                                     }
                                 }
-
+                            }
+                            else
+                            {
+                                free(event->name);
+                                free(event->value);
+                                free(event);
+                                T2Error("Failed to duplicate event memory\n");
                             }
                         }
                     }
-                    else
-                    {
-                        free(event->name);
-                        free(event);
-                        T2Error("Missing event value\n");
-                    }
+                }
+                else
+                {
+                    T2Error("Missing event value\n");
                 }
             }
             else
@@ -197,7 +230,11 @@ void T2ER_Push(char* eventName, char* eventValue)
                 T2Error("%s pthread_mutex_lock for erMutex failed\n", __FUNCTION__);
                 return;
             }
-            if(t2_queue_count(eQueue) > T2EVENTQUEUE_MAX_LIMIT)
+            if(!isValidEventLength(eventName, eventValue))
+            {
+                T2Warning("Dropping event with invalid length for eventName : %s eventValue : %s\n", eventName, eventValue);
+            }
+            else if(t2_queue_count(eQueue) > T2EVENTQUEUE_MAX_LIMIT)
             {
                 T2Warning("T2EventQueue max limit : %d reached, dropping packet for eventName : %s eventValue : %s\n",
                           T2EVENTQUEUE_MAX_LIMIT, eventName, eventValue);
@@ -210,9 +247,18 @@ void T2ER_Push(char* eventName, char* eventValue)
                 {
                     event->name = strdup(eventName);
                     event->value = strdup(eventValue);
-                    T2Debug("Adding eventName : %s eventValue : %s to t2event queue\n", event->name, event->value);
-                    t2_queue_push(eQueue, (void *) event);
-
+                    if(event->name != NULL && event->value != NULL)
+                    {
+                        T2Debug("Adding eventName : %s eventValue : %s to t2event queue\n", event->name, event->value);
+                        t2_queue_push(eQueue, (void *) event);
+                    }
+                    else
+                    {
+                        free(event->name);
+                        free(event->value);
+                        free(event);
+                        T2Error("Failed to duplicate event memory\n");
+                    }
                 }
 
             }
@@ -404,7 +450,7 @@ T2ERROR T2ER_Init()
         registerForTelemetryEvents(T2ER_PushDataWithDelim);
     }
 
-    if (system("touch /tmp/.t2ReadyToReceiveEvents") != 0)
+    if (!createSecureTempFlag("/tmp/.t2ReadyToReceiveEvents"))
     {
         T2Error("Failed to create /tmp/.t2ReadyToReceiveEvents flag file\n");
     }

source/ccspinterface/rbusInterface.c

@@ -1038,6 +1038,10 @@ static rbusError_t dcmOnDemandMethodHandler(rbusHandle_t handle, char const* met
             if(pthread_create(&rpOnDemandTh, &rpOnDemandAttr, reportOnDemandCallBack, ON_DEMAND_ACTION_UPLOAD) != 0)
             {
                 T2Error("Failed to create thread for report on demand.\n");
+                onDemandReportCallBackHandler = NULL;
+                pthread_mutex_unlock(&asyncMutex);
+                pthread_attr_destroy(&rpOnDemandAttr);
+                return RBUS_ERROR_BUS_ERROR;
             }
             pthread_attr_destroy(&rpOnDemandAttr);
 
@@ -1079,20 +1083,9 @@ static rbusError_t dcmOnDemandMethodHandler(rbusHandle_t handle, char const* met
     }
     else if(!strncmp(methodName, T2_ABORT_ON_DEMAND_REPORT, maxParamLen))
     {
-
         T2Info("%s Aborting previous ondemand report upload %s \n", __FUNCTION__, methodName);
+        T2Info("%s Abort is no longer supported; request is accepted without creating a detached worker thread to avoid thread-flood DoS\n", __FUNCTION__);
 
-        pthread_t rpOnDemandTh;
-        pthread_attr_t rpOnDemandAttr;
-        pthread_attr_init(&rpOnDemandAttr);
-        pthread_attr_setdetachstate(&rpOnDemandAttr, PTHREAD_CREATE_DETACHED);
-        // Calls within reportOnDemandCallBack are thread safe, thread synchronization is not required
-        if(pthread_create(&rpOnDemandTh, &rpOnDemandAttr, reportOnDemandCallBack, ON_DEMAND_ACTION_ABORT) != 0)
-        {
-            T2Error("Failed to create thread for report on demand.\n");
-        }
-
-        pthread_attr_destroy(&rpOnDemandAttr);
         if(NULL != asyncCallBackHandle)
         {
             rbusObject_t outputParams;