Fix security vulnerabilities across codebase

.github/workflows/build-jp502.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 5.0.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 5.0.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 5.0.2
     - name: build
       run: ./build_all.sh 5.0.2

.github/workflows/build-jp512.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 5.1.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 5.1.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 5.1.2
     - name: build
       run: ./build_all.sh 5.1.2

.github/workflows/build-jp6.1.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.1
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.1
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.1
     - name: build
       run: ./build_all.sh 6.1

.github/workflows/build-jp6.2.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.2
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.2
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.2
     - name: build
       run: ./build_all.sh 6.2

.github/workflows/build-jp6.yml

@@ -20,6 +20,9 @@ jobs:
     - name: setup workspace
       run: yes | ./setup_workspace.sh 6.0
     - name: apply patches
-      run: git config --global user.email "builder@example.com" && git config --global user.name "builder" && ./apply_patches.sh 6.0
+      run: |
+        git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+        git config --global user.name "${{ github.actor }}"
+        ./apply_patches.sh 6.0
     - name: build
       run: ./build_all.sh 6.0

build_all.sh

@@ -59,11 +59,15 @@ export TEGRA_KERNEL_OUT="$DEVDIR/images/$1"
 # Clean if requested
 if [[ $CLEAN == 1 ]]; then
     echo "Cleaning build artifacts for $1..."
-    rm -rf $TEGRA_KERNEL_OUT
-    rm -rf $SRCS/out
+    if [[ -z "$TEGRA_KERNEL_OUT" ]]; then
+        echo "Error: TEGRA_KERNEL_OUT is not set"
+        exit 1
+    fi
+    rm -rf "$TEGRA_KERNEL_OUT"
+    rm -rf "$SRCS/out"
 fi
 
-mkdir -p $TEGRA_KERNEL_OUT
+mkdir -p "$TEGRA_KERNEL_OUT"
 export KERNEL_MODULES_OUT=$TEGRA_KERNEL_OUT/modules
 
 # Check if BUILD_NUMBER is set as it will add a postfix to the kernel name "vermagic" (normally it happens on CI who have BUILD_NUMBER defined)
@@ -75,7 +79,7 @@ export KERNEL_MODULES_OUT=$TEGRA_KERNEL_OUT/modules
 if [[ "$JETPACK_VERSION" == "6.x" ]]; then
     cd $SRCS
     export KERNEL_HEADERS=$SRCS/kernel/kernel-jammy-src
-    ln -sf $TEGRA_KERNEL_OUT $SRCS/out
+    ln -sf "$TEGRA_KERNEL_OUT" "$SRCS/out"
     if [[ "$DEVDBG" == "1" ]]; then
         cd $KERNEL_HEADERS
         # Generate .config file from default defconfig
@@ -99,7 +103,7 @@ if [[ "$JETPACK_VERSION" == "6.x" ]]; then
     fi
     make ARCH=arm64 modules
     make ARCH=arm64 dtbs
-    mkdir -p $TEGRA_KERNEL_OUT/rootfs/boot/dtb
+    mkdir -p "$TEGRA_KERNEL_OUT"/rootfs/boot/dtb
     cp $SRCS/nvidia-oot/device-tree/platform/generic-dts/dtbs/tegra234-p3737-0000+p3701-0000-nv.dtb $TEGRA_KERNEL_OUT/rootfs/boot/dtb/
     cp $SRCS/nvidia-oot/device-tree/platform/generic-dts/dtbs/tegra234-p3737-0000+p3701-0005-nv.dtb $TEGRA_KERNEL_OUT/rootfs/boot/dtb/
     cp $SRCS/nvidia-oot/device-tree/platform/generic-dts/dtbs/tegra234-camera-d4xx-overlay*.dtbo $TEGRA_KERNEL_OUT/rootfs/boot/

test/install.tegra.artifacts.sh

@@ -1,8 +1,12 @@
 #!/bin/bash
 set -e
 
-# add jenkins user to sudo group
-# add the following line to /etc/sudoers for jenkins user, here nvidia
+# SECURITY WARNING: The sudoers configuration below grants passwordless root access.
+# Only use in isolated CI/CD environments with restricted network access.
+# Never enable on production systems or systems with sensitive data.
+# Consider using dedicated CI service accounts with audit logging.
+#
+# To enable for jenkins/CI user (NOT RECOMMENDED for production):
 # nvidia ALL=(root) NOPASSWD: /sbin/reboot, /sbin/install.tegra.artifacts.sh
 
 RELEASE=$(ls lib/modules)

test/test_fw_version.py

@@ -1,15 +1,24 @@
 import subprocess
 import pytest
+import re
+
+def validate_video_device(device):
+    """Validate device is a safe video device path."""
+    # Accept only video device numbers (0-99)
+    if not re.match(r'^[0-9]{1,2}$', str(device)):
+        raise ValueError(f"Invalid device: {device}. Expected video device number (0-99)")
+    return str(device)
 
 @pytest.mark.d457
 @pytest.mark.parametrize("device", {'0'})
 def test_fw_version(device):
     try:
+        device = validate_video_device(device)
         key = "fw_version"
-        result = subprocess.check_call(["v4l2-ctl", "-d"+device, "-C", key])
+        result = subprocess.check_call(["v4l2-ctl", "-d", device, "-C", key])
         assert result == 0
 
-        std_output = subprocess.check_output(["v4l2-ctl", "-d"+device, "-C", key])
+        std_output = subprocess.check_output(["v4l2-ctl", "-d", device, "-C", key])
         key += ": "
         assert key in std_output.decode(), "Couldn't fetch FW version"
 
@@ -23,11 +32,22 @@ def test_fw_version(device):
         assert fw_version == (fw_version & 0x05FFFFFF), "Expected FW version is 5.x.x.x, but received {}".format(fw_version_str)
 
         # Get DFU device name
-        dfu_device = subprocess.check_output(["ls", "/sys/class/d4xx-class/"]).decode()
-        assert "d4xx-dfu-" in dfu_device, "D4xx DFU device not found"
+        dfu_device_output = subprocess.check_output(["ls", "/sys/class/d4xx-class/"]).decode()
+
+        # Parse ls output, which may contain multiple entries, and select a valid DFU device
+        dfu_entries = [line.strip() for line in dfu_device_output.splitlines() if line.strip()]
+        dfu_pattern = re.compile(r'^d4xx-dfu-[0-9]+$')
+        dfu_device_name = None
+        for entry in dfu_entries:
+            if dfu_pattern.match(entry):
+                dfu_device_name = entry
+                break
+
+        assert dfu_device_name is not None, "D4xx DFU device not found"
 
         # Get FW version from DFU device info
-        dfu_device_info = subprocess.check_output(["cat", "/dev/"+dfu_device.strip()]).decode()
+        dfu_device_path = f"/dev/{dfu_device_name}"
+        dfu_device_info = subprocess.check_output(["cat", dfu_device_path]).decode()
 
         # Check whether the DFU info also has same FW version
         assert fw_version_str in dfu_device_info, "FW versions read through v4l2-ctl utility and DFU device info doesn't match"

test/test_metadata/framesextract.c

@@ -73,7 +73,8 @@ void process_frame_data(void){
             char *token;
             unsigned int col = 0;
             char tmp[1024];
-            strcpy(tmp, line);
+            strncpy(tmp, line, sizeof(tmp) - 1);
+            tmp[sizeof(tmp) - 1] = '\0';
             token = strtok(tmp, ",");
             unsigned long int curr_val = 0;
             while (token && col < 3) {
@@ -128,7 +129,8 @@ void process_frame_data(void){
                 while (fgets(line, sizeof(line), csv)) {
                     lines[count] = strdup(line);
                     char tmp[1024];
-                    strcpy(tmp, line);
+                    strncpy(tmp, line, sizeof(tmp) - 1);
+                    tmp[sizeof(tmp) - 1] = '\0';
                     char *token = strtok(tmp, ",");
                     int col = 0;
                     while (token && col < 3) {

utilities/streamApp/ds5_fw_logger.cpp

@@ -112,7 +112,10 @@ int main(int argc, char *argv[])
 			cout << "FW_Log_Data:";
 			for (i = 4; i < sizeof(ds5_fw_log_msg) + HEADER_SIZE; i++)
 			{
-				cout << uppercase << std::setfill ('0') << setw(2) << std::hex << (int)log[j*sizeof(ds5_fw_log_msg)+i] << " ";
+				size_t idx = j * sizeof(ds5_fw_log_msg) + i;
+				if (idx >= sizeof(log))
+					break;
+				cout << uppercase << std::setfill ('0') << setw(2) << std::hex << (int)log[idx] << " ";
 			}
 			cout << endl;
 			last_seq = msg->seq_id;

utilities/streamApp/gui/StreamView.cpp

@@ -232,7 +232,19 @@ int StreamView::start(uint32_t memoryType) {
         break;
     case V4L2_MEMORY_USERPTR:
         for (int i = 0; i < mBuffersCount; i++) {
-            mRsBuffers.emplace_back(malloc(bufferLength), bufferLength, i);
+            void* ptr = malloc(bufferLength);
+            if (ptr == nullptr) {
+                RS_LOGE("Failed to allocate buffer %d of size %u", i, bufferLength);
+                // Free previously allocated buffers before returning
+                for (auto& buf : mRsBuffers) {
+                    if (buf.buffer != nullptr) {
+                        free(buf.buffer);
+                    }
+                }
+                mRsBuffers.clear();
+                return -1;
+            }
+            mRsBuffers.emplace_back(ptr, bufferLength, i);
         }
         break;
     default:
@@ -281,7 +293,19 @@ void StreamView::processCaptureResult(uint32_t index)
     uint32_t cnt = 0;
     char* left;
     char* right;
-    char image[mFormat.calcBytesPerFrame()];
+    // Use static heap allocation instead of VLA to prevent stack overflow
+    // Static buffer is reused across calls to avoid per-frame allocation overhead
+    uint32_t frameSize = mFormat.calcBytesPerFrame();
+    constexpr uint32_t MAX_FRAME_SIZE = 64 * 1024 * 1024; // 64MB max
+    if (frameSize == 0 || frameSize > MAX_FRAME_SIZE) {
+        RS_LOGE("Invalid frame size: %u", frameSize);
+        return;
+    }
+    static std::vector<char> imageVec;
+    if (imageVec.size() < frameSize) {
+        imageVec.resize(frameSize);
+    }
+    char* image = imageVec.data();
     //lock_guard<mutex> lock(mMutex);
     switch(mStreamType) {
     case V4L2Utils::StreamUtils::StreamType::RS_DEPTH_STREAM:

utilities/streamApp/hwmc.cpp

@@ -6,6 +6,7 @@
 #include <vector>
 #include <cstring>
 #include <iomanip>
+#include <algorithm>
 
 #include <fcntl.h>
 #include <sys/ioctl.h>
@@ -22,11 +23,16 @@ using namespace realsense::utils;
 
 #pragma pack(push, 1)
 struct HWMC {
-	HWMC(const vector<int32_t> &inParams):header(0x14), magic_word(0xCDAB) {
-		opcode = inParams[0];
+	HWMC(const vector<int32_t> &inParams):header(0x14), magic_word(0xCDAB), opcode(0) {
 		memset(params, 0, sizeof(params));
-		for (size_t i = 1; i < inParams.size(); i++)
-			params[i-1] = inParams[i];
+		if (inParams.empty()) {
+			cerr << "Error: HWMC requires at least an opcode" << endl;
+			return;
+		}
+		opcode = inParams[0];
+		size_t paramCount = std::min(inParams.size() - 1, sizeof(params)/sizeof(params[0]));
+		for (size_t i = 0; i < paramCount; i++)
+			params[i] = inParams[i + 1];
 	}
 	uint16_t header = 0x14;
 	uint16_t magic_word = 0xCDAB;
@@ -64,7 +70,7 @@ int main(int argc, char *argv[]) {
 	if (!fd)
 		return -1;
 
-	uint8_t hwmcBuff[1028] {0};
+	uint8_t hwmcBuff[1024 + sizeof(struct HWMC)] {0};
 	memset(hwmcBuff, 0, sizeof(hwmcBuff));
 
 	struct v4l2_ext_control ctrl {0};
@@ -84,9 +90,13 @@ int main(int argc, char *argv[]) {
             return -1;
         }
 	if (hmc.opcode == *(hwmcBuff + sizeof(struct HWMC))) {
-	uint16_t outLen = hwmcBuff[1001 + sizeof(struct HWMC)] << 8;
+		uint16_t outLen = hwmcBuff[1001 + sizeof(struct HWMC)] << 8;
 		outLen |= hwmcBuff[1000 + sizeof(struct HWMC)];
 		cout << "output length: "<< outLen << endl;;
+		// Bounds check: ensure we don't read past buffer
+		uint16_t maxLen = sizeof(hwmcBuff) - sizeof(struct HWMC) - 4;
+		if (outLen > maxLen)
+			outLen = maxLen;
 		for (int i = 0; i < outLen; ++i) {
 			if (i != 0 && 0 == (i % 16))
 				cout << endl;