RDKB-65777 - #1316
Conversation
|
I have read the CLA Document and I hereby sign the CLA You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot. |
There was a problem hiding this comment.
Pull request overview
This PR addresses multiple Coverity findings across the WiFi stack (mesh services, Passpoint/DML, OVSDB helpers, and controller handlers) primarily by tightening memory/resource handling and correcting edge-case checks.
Changes:
- Fix potential leaks/cleanup gaps (cJSON, OVSDB-selected records, temporary buffers).
- Adjust scan candidate accounting and cleanup in mesh “ext connected scan results” flows.
- Harden a few boundary/error cases (e.g., radio index validation, OVSDB select return semantics).
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| source/services/mesh/wifi_service_mesh.c | Adjusts candidate list accounting and frees scan list when no candidate is found. |
| source/dml/tr_181/ml/cosa_wifi_dml.c | Adds missing cJSON_Delete() calls and ensures fetched strings are freed. |
| source/db/wifi_db_apis.c | Treats empty OVSDB results as “not found” and adds missing frees on some paths. |
| source/core/wifi_passpoint.c | Attempts to address a JSON cleanup issue in WiFi_SetGasConfig(). |
| source/core/wifi_ctrl_webconfig.c | Ensures webconfig subdoc data is freed regardless of encode result. |
| source/core/wifi_ctrl_rbus_handlers.c | Frees harvester buffer on allocation failure before returning. |
| source/core/services/vap_svc_mesh_ext.c | Adds malloc failure handling and corrects scan_count tracking for matches. |
| source/apps/levl/wifi_levl.c | Corrects radio index bounds check for 1-based event naming. |
| lib/ovsdb/ovsdb_table.c | Fixes onewifi_ovsdb_table_select_where() to return NULL on failure/empty results instead of a potentially freed pointer. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if ((ext->candidates_list.scan_list == NULL) && num) { | ||
| ext->candidates_list.scan_list = (bss_candidate_t *) malloc(num * sizeof(bss_candidate_t)); | ||
| scan_list = ext->candidates_list.scan_list; | ||
| ext->candidates_list.scan_count = num; | ||
| } else { |
| #else | ||
| UNREFERENCED_PARAMETER(JSON_STR); | ||
| #endif | ||
| #endif | ||
| cJSON_Delete(passPointCfg); | ||
| return RETURN_ERR; |
| if((convert_radio_name_to_index(&index,pcfg->radio_name))!=0) | ||
| { | ||
| wifi_util_dbg_print(WIFI_DB,"%s:%d: %s invalid radio name \n",__func__, __LINE__,pcfg->radio_name); | ||
| free(pcfg); | ||
| return RETURN_ERR; |
Reason for change: Fixing coverity issues. Test Procedure: Build should be successful and the regression test should also succeed. Risks: Low Priority: P1 Signed-off-by: Kondamma_Kudumula@comcast.com
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
source/db/wifi_db_apis.c:2514
- On error returns after fetching pcfg, the function returns without freeing pcfg (e.g., invalid vap_name/radio_index/band). This leaks the selected record array; the success path frees pcfg at the end, so these early returns should also free it.
if (pcfg == NULL || count == 0) {
wifidb_print("%s:%d Table table_Wifi_Security_Config table not found, entry count=%d \n",__func__, __LINE__, count);
return -1;
}
| ext->candidates_list.scan_count = scan_list - ext->candidates_list.scan_list; | ||
| / | ||
| if (found_candidate) { |
Reason for change: Fixing coverity issues.
Test Procedure: Build should be successful and the regression test should also succeed.
Risks: Low
Priority: P1
Signed-off-by: Kondamma_Kudumula@comcast.com