RDKB-65853: Fixing coverity issue

[bharathivelp]

Reason for change: Fixing coverity issues.
Test Procedure: Build should be successful and the regression test should also succeed
Risks: Low
Priority: P1
Signed-off-by: Velpula_Bharathi@comcast.com

[Copilot]

Pull request overview

This PR addresses several Coverity-reported issues across webconfig decoding/translation, PSM MAC filter handling, and WiFi event cloning/copying—primarily by adding null checks, fixing a use-after-free log path, and tightening monitor event payload sizing/copying.

Changes:

• Prevent null dereference when translating associated-device stats to EasyMesh when stats are absent.
• Fix a use-after-free in assoc-device stats decode logging by logging size instead of dereferencing a freed pointer.
• Improve monitor event memory handling by tracking/copying the actual monitor payload size (mon_data_len) and allocating/copying only what’s needed for specific monitor subtypes.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
source/webconfig/wifi_easymesh_translator.c	Adds guard for missing stats input to avoid null dereference during translation.
source/webconfig/wifi_decoder.c	Fixes use-after-free in logging when assoc-device stats array size is 0.
source/dml/wifi_ssp/ssp_loop.c	Avoids freeing a hash-map key after insertion by nulling the pointer before cleanup.
source/core/wifi_events.c	Adds monitor payload sizing, stores mon_data_len, and uses it for cloning/copying monitor events.
source/apps/wifi_apps_mgr.c	Adjusts link-quality event creation to avoid unnecessary allocation when handing off owned buffers.
include/wifi_events.h	Extends wifi_event_t with mon_data_len to support variable-sized monitor payloads.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

source/dml/wifi_ssp/ssp_loop.c:1224

• mcfg_mac is allocated with strdup() and then the function can return before the final free(mcfg_mac); (e.g., when the MAC entry already exists or malloc() for temp_mac_entry fails). This leaks memory. Since hash_map_put() takes ownership of the key on success (collection.c:172-184), freeing mcfg_mac is only needed on these early-return paths before insertion.

                if (hash_map_put(psm_mac_map, mcfg_mac, temp_mac_entry) != 0)
                {
                    free(mcfg_mac);
                    free(temp_mac_entry);
                    return;
                }
                mcfg_mac = NULL;

source/apps/wifi_apps_mgr.c:242

• get_app_by_inst() can return NULL (other call sites check for this), but this function unconditionally dereferences app->desc.event_fn, which can crash if the link-quality app wasn’t registered/initialized. Add a NULL check and clean up the allocated event on error.

    event = (wifi_event_t *)create_wifi_event(0, type, sub_type);
    if (event == NULL) {
        wifi_util_error_print(WIFI_APPS, "%s %d failed to allocate memory to event\n",__FUNCTION__, __LINE__);
        return RETURN_ERR;
    }

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/apps/wifi_apps_mgr.c:253

• In apps_mgr_link_quality_event, the event is created with msg_len = 0 (so core_data.msg is not allocated), but when arg != NULL the code assigns event->u.core_data.msg = arg. destroy_wifi_event() will later free(event->u.core_data.msg), which will attempt to free memory owned by the caller (or even stack memory), causing crashes/double-frees. The event should allocate its own buffer and copy arg, consistent with other event helpers in this file.

    event = (wifi_event_t *)create_wifi_event(0, type, sub_type);
    if (event == NULL) {
        wifi_util_error_print(WIFI_APPS, "%s %d failed to allocate memory to event\n",__FUNCTION__, __LINE__);
        return RETURN_ERR;
    }

    if (arg == NULL) {
        event->u.core_data.msg = NULL;
        event->u.core_data.len = 0;
    } else {
        /* copy msg to data */
        event->u.core_data.msg  = arg;
        event->u.core_data.len = len;
        event->event_type = type;
        event->sub_type = sub_type;
    }