RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

[im1308]

RDKB-65948: [8.6p1s2]Observed CcspLMLite Crash due to Presence Detection with Fingerprint 44028269

---

RootCause and Fix:

---

The crash at len = strlen(value) is a stale-handle use-after-free. Host_GetEntry returns the row handle after releasing LmHostObjectMutex; the CCSP framework caches it and later calls Host_GetParamStringValue. If the LM background thread deletes/reallocates that host in between, pHost->pStringParaValue[i] is a non-NULL garbage pointer, so strlen faults. The value == NULL check can't catch it.

Adding a new helper IsValidHostHandle() to verify that the PLmObjectHost received through hInsContext still exists in lmHosts.hostArray[].
The validation is performed while holding LmHostObjectMutex, before dereferencing the host object.
If the handle is no longer valid, the function logs a warning, unlocks the mutex, and returns an error instead of dereferencing a potentially stale pointer.

Purpose: Prevent access to a stale PLmObjectHost in case the host entry was removed or replaced after Host_GetEntry() returned the handle.

[Copilot]

Pull request overview

This PR aims to prevent a CcspLMLite crash caused by stale (use-after-free) host instance handles being cached by the CCSP framework and later dereferenced in Host_GetParamStringValue().

Changes:

• Adds IsValidHostHandle() to validate hInsContext (as PLmObjectHost) against lmHosts.hostArray[] under LmHostObjectMutex.
• Adds a guard in Host_GetParamStringValue() to bail out early when a stale host handle is detected.
• Updates GetParamStringValue_common() to use strnlen() (but this currently breaks required-size reporting semantics).

Comments suppressed due to low confidence (1)

source/lm/cosa_hosts_dml.c:156

• strnlen(value, *pUlSize) breaks the TR-181/CCSP GetParamStringValue contract for required-size reporting: when the string is longer than the buffer, strnlen returns *pUlSize, so the code only bumps *pUlSize by 1 instead of returning the full required length. Callers that reallocate and retry once will still fail for long strings.

        len = strnlen(value, *pUlSize); 
        if (len >= *pUlSize)
        {
            *pUlSize = len + 1;
            rc = 1;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Amaresh-Kotekal]

I don't think so, crash occurs here but better to have boundary check, if the caller is passed the buffer without doing proper memset.

[Amaresh-Kotekal]

I feel it is not required because for each get call, it will iterate over all the Hosts.
NULL check and mutex lock is sufficient.

[Amaresh-Kotekal]

In this file, Lot of other places also needs to be handled apart from this function.

[github-actions]

📋 PR Format Reminder

• Description missing:
  • Reason for change
  • Test Procedure
  • Risks (Low / Medium / High)
  • Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/lm/cosa_hosts_dml.c:156

• GetParamStringValue_common() now has a stray block after strnlen(...), which results in an else without a matching if (compile error) and also breaks the buffer-size logic. If the intent is to preserve the original "return 1 and set *pUlSize to required size" behavior, the size check needs to be restored (and using strlen() here is appropriate once the handle is validated elsewhere).

        len = strnlen(value, *pUlSize); 
        {
            *pUlSize = len + 1;
            rc = 1;
        }