Skip to content

CMFSUPPORT-3863. COVERITY TEST. DO NOT MERGE #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
snampo768 wants to merge 2 commits into from
+3 −2
Closed

CMFSUPPORT-3863. COVERITY TEST. DO NOT MERGE #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5682955
CMFSUPPORT-3863. COVERITY TEST. DO NOT MERGE
Feb 20, 2026
5f083bb
Merge branch 'develop' into feature/test-workflow
scthunderbolt Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion source/AdvSecurityDml/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,10 @@
##########################################################################
AM_CFLAGS = -D_ANSC_LINUX
AM_CFLAGS += -D_ANSC_USER
AM_CFLAGS += -Wno-format
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding -Wno-format suppresses compiler warnings for format string mismatches, which would hide serious bugs like format string vulnerabilities and incorrect argument counts. This flag is masking the bug in line 294 of cosa_adv_security_internal.c where fprintf has mismatched format specifiers and arguments. Format warnings should not be suppressed as they catch critical security and correctness issues.

Copilot uses AI. Check for mistakes.
AM_LDFLAGS = -lccsp_common -lsysevent -lwebconfig_framework -lmsgpackc -ltrower-base64

AM_CPPFLAGS = -Wall -Werror
AM_CPPFLAGS = -Wall -Wno-format
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Replacing -Werror with -Wno-format removes the "warnings as errors" enforcement and suppresses format string warnings. This is problematic for two reasons: (1) it allows format string bugs to go undetected, including the critical bug on line 294 of cosa_adv_security_internal.c, and (2) it removes the previous policy of treating all warnings as errors, which weakens code quality enforcement.

Copilot uses AI. Check for mistakes.
ACLOCAL_AMFLAGS = -I m4
hardware_platform = i686-linux-gnu

Expand Down
2 changes: 1 addition & 1 deletion source/AdvSecurityDml/cosa_adv_security_internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,7 +294,7 @@

if ((file = fopen(fpath, "w")))
{
fprintf(file,"%s",str);
fprintf(file,"%s%s",str);

Check failure

Code scanning / Coverity

Missing argument to printf format specifier High

PRINTF_ARGS: No argument for format specifier "%s".

Check notice

Code scanning / Coverity

Printf arg count mismatch Low

PW.TOO_FEW_PRINTF_ARGS: the format string requires additional arguments

Check warning

Code scanning / CodeQL

Too few arguments to formatting function Medium

Format for fprintf expects 2 arguments but given 1

Copilot Autofix

AI 5 days ago

In general, to fix “too few arguments to formatting function” issues, ensure that the number and types of arguments after the format string exactly match the conversion specifiers in the format. You can either (1) adjust the format string to use fewer specifiers, or (2) pass additional arguments so that every specifier has a corresponding value.

In this specific case in source/AdvSecurityDml/cosa_adv_security_internal.c, function advsec_write_to_file, the call:

fprintf(file,"%s%s",str);

uses a format string with two %s specifiers but provides only one argument str. The surrounding logic indicates the function simply writes the given string into the file. There is no indication that anything else should be printed. The safest minimal fix that preserves existing behavior is to change the format string to include only one %s:

fprintf(file, "%s", str);

No new headers or helper functions are required; we just correct the format string at line 297 in the shown snippet. Everything else in the function can remain unchanged.

Suggested changeset 1
source/AdvSecurityDml/cosa_adv_security_internal.c

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/source/AdvSecurityDml/cosa_adv_security_internal.c b/source/AdvSecurityDml/cosa_adv_security_internal.c
--- a/source/AdvSecurityDml/cosa_adv_security_internal.c
+++ b/source/AdvSecurityDml/cosa_adv_security_internal.c
@@ -294,7 +294,7 @@
 
     if ((file = fopen(fpath, "w")))
     {
-        fprintf(file,"%s%s",str);
+        fprintf(file, "%s", str);
         fclose(file);
         return 1;
     }
EOF
@@ -294,7 +294,7 @@

if ((file = fopen(fpath, "w")))
{
fprintf(file,"%s%s",str);
fprintf(file, "%s", str);
fclose(file);
return 1;
}
Copilot is powered by AI and may make mistakes. Always verify output.
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fprintf format string has two format specifiers ("%s%s") but only one argument (str) is provided. This will cause undefined behavior as fprintf will attempt to read a second argument from the stack that doesn't exist. The format string should be "%s" with one argument, not "%s%s".

Suggested change
fprintf(file,"%s%s",str);
fprintf(file, "%s", str);

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor

@rdkcmf-jenkins rdkcmf-jenkins Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Coverity Issue - Printf arg count mismatch

the format string requires additional arguments

Medium Impact, CWE-685
PW.TOO_FEW_PRINTF_ARGS

Copy link
Copy Markdown
Contributor

@rdkcmf-jenkins rdkcmf-jenkins Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Coverity Issue - Missing argument to printf format specifier

No argument for format specifier "%s".

Medium Impact, CWE-685
PRINTF_ARGS

fclose(file);
return 1;
}
Expand Down
Loading