cov-test: Fixing High and medium level issues[DONOT MERGE] by Sid2001-maker · Pull Request #106 · rdkcentral/rdkNativeScript

Sid2001-maker · 2026-01-16T18:25:38Z

RDKEMW-12252: Coverity Scan Report - Analyzing and Fixing all the Critical and High issues

Reason for change: Resolve Critical and high level issues in coverity
Test Procedure: build should be successful
Risk: low
Priority: P2

…tical and High issues Reason for change: Resolve Critical and high level issues in coverity Test Procedure: build should be successful Risk: low Priority: P2

rdkcmf-jenkins · 2026-01-16T18:28:53Z

b'## Blackduck scan failure details

Summary: 0 violations, 0 files pending approval, 1 file pending identification.

Protex Server Path: /home/blackduck/github/rdkNativeScript/106/rdkcentral/rdkNativeScript
Commit: de5ed8d

Report detail: gist'

Copilot

Pull request overview

This pull request addresses Coverity scan issues by fixing critical and high-level defects in the codebase. The changes focus on improving error handling, resource management, input validation, and fixing potential crashes.

Changes:

Added exception handling wrappers in main functions across multiple files
Fixed curl_easy_setopt error handling with proper return values after cleanup
Added input validation for untrusted Wayland display names to prevent injection attacks
Fixed memory leaks and null pointer checks, improved mutex handling

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
src/jsruntime.cpp	Added try-catch exception handlers, input validation for Wayland display, removed unnecessary null check for shared_ptr
src/jsc/jsc_lib/jsc_lib.cpp	Fixed curl error handling, improved exception reporting, optimized path separator check
src/jsc/JavaScriptUtils.cpp	Fixed mutex unlock to use lock guard, added stat/fread error handling, fixed memory leaks in metrics function
src/jsc/JavaScriptEngine.cpp	Fixed format specifier from %d to %f for double value
src/jsc/JavaScriptContext.cpp	Added null check for gAAMPJSBindings, added destructor cleanup for mNetworkMetricsData
src/NativeJSRenderer.cpp	Fixed curl error handling, removed premature mutex unlock, fixed string format specifier, removed uninitialized variable usage in one location but introduced it in another
src/JSRuntimeServer.cpp	Initialized res variable to 0 in error case
src/JSRuntimeClient.cpp	Added exception handlers, improved wait_for with predicate
src/JSRuntimeClientContainer.cpp	Added exception handling in main function
include/IJavaScriptContext.h	Added virtual destructor to interface class

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-16T18:31:26Z

 class IJavaScriptContext
 {
  public:
+    virtual ~IJavaScriptContext() = default; //change added


The comment "//change added" is unclear and unnecessary. Comments should explain why code exists, not document when it was added (that's what version control is for).

Suggested change

virtual ~IJavaScriptContext() = default; //change added

virtual ~IJavaScriptContext() = default;

Copilot · 2026-01-16T18:31:27Z

+
+        std::string ipAddress = JSRuntimeContainer::getContainerIpAddress(containerId);
+        if (ipAddress.empty()) {
+            NativeJSLogger::log(ERROR, "Failed to retrieve IP address for container");


Missing newline character in the log message format string. The message should end with \n for proper logging output formatting.

Copilot · 2026-01-16T18:31:27Z

+        return 1;
+    }
+    catch (...) {
+        NativeJSLogger::log(ERROR, "Unknown exception in main");


Missing newline character in the log message format string. The message should end with \n for proper logging output formatting.

Copilot · 2026-01-16T18:31:27Z

+        }
+        res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYHOST: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+        }
+        res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, true);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYPEER: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+        }
+        res = curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_USERAGENT: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+
+        }
+        res = curl_easy_setopt(curl, CURLOPT_PROXY, "");
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_PROXY: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);


After curl_easy_cleanup is called on error, the function continues executing with the same curl handle which is now invalid. After each error case with curl_easy_cleanup, the function should return immediately to avoid using the freed handle.

Suggested change

}

res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYHOST: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

}

res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, true);

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYPEER: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

}

res = curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_USERAGENT: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

}

res = curl_easy_setopt(curl, CURLOPT_PROXY, "");

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_PROXY: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

return ret;

}

res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYHOST: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

return ret;

}

res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, true);

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYPEER: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

return ret;

}

res = curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_USERAGENT: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

return ret;

}

res = curl_easy_setopt(curl, CURLOPT_PROXY, "");

if (res != CURLE_OK) {

NativeJSLogger::log(ERROR, "Failed to set CURLOPT_PROXY: %s\n", curl_easy_strerror(res));

curl_easy_cleanup(curl);

return ret;

Copilot · 2026-01-16T18:31:28Z

+        res = curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_URL: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_FOLLOWLOCATION: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, CallbackHeader);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_HEADERFUNCTION: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_HEADERDATA, (void *)&chunk);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_HEADERDATA: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, CallbackOnMemoryWrite);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_WRITEFUNCTION: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_WRITEDATA, (void *)&chunk);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_WRITEDATA: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_TIMEOUT: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_NOSIGNAL: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYHOST: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, true);
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_SSL_VERIFYPEER: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_USERAGENT, "libcurl-agent/1.0");
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_USERAGENT: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }
+        res = curl_easy_setopt(curl, CURLOPT_PROXY, "");
+        if (res != CURLE_OK) {
+            NativeJSLogger::log(ERROR, "Failed to set CURLOPT_PROXY: %s\n", curl_easy_strerror(res));
+            curl_easy_cleanup(curl);
+            return ret;
+        }


After curl_easy_cleanup is called on error, the function continues executing with the same curl handle which is now invalid. After each error case with curl_easy_cleanup, the function should return immediately to avoid using the freed handle.

Copilot · 2026-01-16T18:31:29Z

+        return 0;
+    }
+    catch (const std::exception& e) {
+        NativeJSLogger::log(ERROR, "Exception in main: %s", e.what());


Missing newline character in the log message format string. The message should end with \n for proper logging output formatting.

Copilot · 2026-01-16T18:31:29Z

        if(!mTestFileName.empty())
        {
            ModuleSettings settings;
+            uint32_t id;


The variable 'id' is declared but not initialized before being passed to ApplicationRequest constructor. This will result in undefined behavior as the uninitialized value is used to construct the ApplicationRequest object and subsequently used in createApplicationInternal and runApplicationInternal calls.

Suggested change

uint32_t id;

uint32_t id = 0;

Copilot · 2026-01-16T18:31:29Z

 	else
 	{
-		NativeJSLogger::log(ERROR, "Unable to find application with id: %d and url: %s\n", id, mContextMap[id].url);
+		NativeJSLogger::log(ERROR, "Unable to find application with id: %d and url: %s\n", id, mContextMap[id].url.c_str());


This code attempts to access mContextMap[id] in the else branch when the id was not found in the map (mapEntry == mContextMap.end()). This will either create a new invalid entry in the map or access uninitialized memory, potentially causing a crash or undefined behavior.

Suggested change

NativeJSLogger::log(ERROR, "Unable to find application with id: %d and url: %s\n", id, mContextMap[id].url.c_str());

NativeJSLogger::log(ERROR, "Unable to find application with id: %d\n", id);

Copilot · 2026-01-16T18:31:29Z

  rtValue keys;
  if (map->Get("allKeys", &keys) != RT_OK) {
    rtLogWarn("Could not retrieve url for network metrics data.");
+    delete netMetricsArray; //newly added


The comment "//newly added" is unnecessary and should be removed. Comments should explain why code exists, not document when it was added (that's what version control is for).

Copilot · 2026-01-16T18:31:30Z


  if (!keysArray) {
    rtLogWarn("No url found in the network metrics data.");
+    delete netMetricsArray; //newly added


The comment "//newly added" is unnecessary and should be removed. Comments should explain why code exists, not document when it was added (that's what version control is for).

RDKEMW-12252: Coverity Scan Report - Analyzing and Fixing all the Cri…

de5ed8d

…tical and High issues Reason for change: Resolve Critical and high level issues in coverity Test Procedure: build should be successful Risk: low Priority: P2

Sid2001-maker requested a review from a team as a code owner January 16, 2026 18:25

Copilot AI review requested due to automatic review settings January 16, 2026 18:25

Copilot started reviewing on behalf of Sid2001-maker January 16, 2026 18:26 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

Sid2001-maker closed this Jan 16, 2026

Sid2001-maker deleted the topic/RDKEMW-12252 branch January 16, 2026 18:32

github-actions Bot locked and limited conversation to collaborators Jan 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

cov-test: Fixing High and medium level issues[DONOT MERGE]#106

cov-test: Fixing High and medium level issues[DONOT MERGE]#106
Sid2001-maker wants to merge 1 commit into
developfrom
topic/RDKEMW-12252

Sid2001-maker commented Jan 16, 2026

Uh oh!

rdkcmf-jenkins commented Jan 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Copilot AI Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	virtual ~IJavaScriptContext() = default; //change added
	virtual ~IJavaScriptContext() = default;

	NativeJSLogger::log(ERROR, "Unable to find application with id: %d and url: %s\n", id, mContextMap[id].url.c_str());
	NativeJSLogger::log(ERROR, "Unable to find application with id: %d\n", id);

Uh oh!

Conversation

Sid2001-maker commented Jan 16, 2026

Uh oh!

rdkcmf-jenkins commented Jan 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants