Fix security vulnerabilities across codebase

- Add bounds checking for buffer access in ds5_fw_logger.cpp
- Fix buffer overflow in hwmc.cpp (increased buffer size + validation)
- Replace VLA with heap allocation in StreamView.cpp to prevent stack overflow
- Add malloc null-check in StreamView.cpp
- Quote shell variables and add validation in build_all.sh
- Replace unsafe strcpy with strncpy in framesextract.c
- Add input validation for device paths in test_fw_version.py
- Add security warning for NOPASSWD sudoers in install.tegra.artifacts.sh
- Use GitHub actor variable instead of hardcoded git identity in workflows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: sareluzi

.github/workflows/build-jp502.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 5.0.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 5.0.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 5.0.2
     - name: build
       run: ./build_all.sh 5.0.2

.github/workflows/build-jp512.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 5.1.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 5.1.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 5.1.2
     - name: build
       run: ./build_all.sh 5.1.2

.github/workflows/build-jp6.1.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.1
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.1
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.1
     - name: build
       run: ./build_all.sh 6.1

.github/workflows/build-jp6.2.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.2
     - name: build
       run: ./build_all.sh 6.2

.github/workflows/build-jp6.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.0
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.0
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.0
     - name: build
       run: ./build_all.sh 6.0

build_all.sh

@@ -59,8 +59,12 @@ export TEGRA_KERNEL_OUT="$DEVDIR/images/$1"
 # Clean if requested
 if [[ $CLEAN == 1 ]]; then
     echo "Cleaning build artifacts for $1..."
-    rm -rf $TEGRA_KERNEL_OUT
-    rm -rf $SRCS/out
+    if [[ -z "$TEGRA_KERNEL_OUT" ]]; then
+        echo "Error: TEGRA_KERNEL_OUT is not set"
+        exit 1
+    fi
+    rm -rf "$TEGRA_KERNEL_OUT"
+    rm -rf "$SRCS/out"
 fi
 
 mkdir -p $TEGRA_KERNEL_OUT
@@ -75,7 +79,7 @@ export KERNEL_MODULES_OUT=$TEGRA_KERNEL_OUT/modules
 if [[ "$JETPACK_VERSION" == "6.x" ]]; then
     cd $SRCS
     export KERNEL_HEADERS=$SRCS/kernel/kernel-jammy-src
-    ln -sf $TEGRA_KERNEL_OUT $SRCS/out
+    ln -sf "$TEGRA_KERNEL_OUT" "$SRCS/out"
     if [[ "$DEVDBG" == "1" ]]; then
         cd $KERNEL_HEADERS
         # Generate .config file from default defconfig

test/install.tegra.artifacts.sh

@@ -1,8 +1,12 @@
 #!/bin/bash
 set -e
 
-# add jenkins user to sudo group
-# add the following line to /etc/sudoers for jenkins user, here nvidia
+# SECURITY WARNING: The sudoers configuration below grants passwordless root access.
+# Only use in isolated CI/CD environments with restricted network access.
+# Never enable on production systems or systems with sensitive data.
+# Consider using dedicated CI service accounts with audit logging.
+#
+# To enable for jenkins/CI user (NOT RECOMMENDED for production):
 # nvidia ALL=(root) NOPASSWD: /sbin/reboot, /sbin/install.tegra.artifacts.sh
 
 RELEASE=$(ls lib/modules)

test/test_fw_version.py

@@ -1,15 +1,24 @@
 import subprocess
 import pytest
+import re
+
+def validate_video_device(device):
+    """Validate device is a safe video device path."""
+    # Accept only video device numbers (0-99)
+    if not re.match(r'^[0-9]{1,2}$', str(device)):
+        raise ValueError(f"Invalid device: {device}. Expected video device number (0-99)")
+    return str(device)
 
 @pytest.mark.d457
 @pytest.mark.parametrize("device", {'0'})
 def test_fw_version(device):
     try:
+        device = validate_video_device(device)
         key = "fw_version"
-        result = subprocess.check_call(["v4l2-ctl", "-d"+device, "-C", key])
+        result = subprocess.check_call(["v4l2-ctl", "-d", device, "-C", key])
         assert result == 0
 
-        std_output = subprocess.check_output(["v4l2-ctl", "-d"+device, "-C", key])
+        std_output = subprocess.check_output(["v4l2-ctl", "-d", device, "-C", key])
         key += ": "
         assert key in std_output.decode(), "Couldn't fetch FW version"
 
@@ -26,8 +35,14 @@ def test_fw_version(device):
         dfu_device = subprocess.check_output(["ls", "/sys/class/d4xx-class/"]).decode()
         assert "d4xx-dfu-" in dfu_device, "D4xx DFU device not found"
 
+        # Validate DFU device name to prevent path traversal
+        dfu_device_name = dfu_device.strip()
+        if not re.match(r'^d4xx-dfu-[0-9]+$', dfu_device_name):
+            raise ValueError(f"Invalid DFU device name: {dfu_device_name}")
+
         # Get FW version from DFU device info
-        dfu_device_info = subprocess.check_output(["cat", "/dev/"+dfu_device.strip()]).decode()
+        dfu_device_path = f"/dev/{dfu_device_name}"
+        dfu_device_info = subprocess.check_output(["cat", dfu_device_path]).decode()
 
         # Check whether the DFU info also has same FW version
         assert fw_version_str in dfu_device_info, "FW versions read through v4l2-ctl utility and DFU device info doesn't match"

test/test_metadata/framesextract.c

@@ -73,7 +73,8 @@ void process_frame_data(void){
             char *token;
             unsigned int col = 0;
             char tmp[1024];
-            strcpy(tmp, line);
+            strncpy(tmp, line, sizeof(tmp) - 1);
+            tmp[sizeof(tmp) - 1] = '\0';
             token = strtok(tmp, ",");
             unsigned long int curr_val = 0;
             while (token && col < 3) {
@@ -128,7 +129,8 @@ void process_frame_data(void){
                 while (fgets(line, sizeof(line), csv)) {
                     lines[count] = strdup(line);
                     char tmp[1024];
-                    strcpy(tmp, line);
+                    strncpy(tmp, line, sizeof(tmp) - 1);
+                    tmp[sizeof(tmp) - 1] = '\0';
                     char *token = strtok(tmp, ",");
                     int col = 0;
                     while (token && col < 3) {

utilities/streamApp/ds5_fw_logger.cpp

@@ -112,7 +112,10 @@ int main(int argc, char *argv[])
 			cout << "FW_Log_Data:";
 			for (i = 4; i < sizeof(ds5_fw_log_msg) + HEADER_SIZE; i++)
 			{
-				cout << uppercase << std::setfill ('0') << setw(2) << std::hex << (int)log[j*sizeof(ds5_fw_log_msg)+i] << " ";
+				size_t idx = j * sizeof(ds5_fw_log_msg) + i;
+				if (idx >= sizeof(log))
+					break;
+				cout << uppercase << std::setfill ('0') << setw(2) << std::hex << (int)log[idx] << " ";
 			}
 			cout << endl;
 			last_seq = msg->seq_id;