From 5036bb78415e1a3b8898a300457b140a45ef93c7 Mon Sep 17 00:00:00 2001
From: "Amarnath Kumar, Deepak" <deepak.amarnath.kumar@intel.com>
Date: Sun, 13 Sep 2026 10:32:32 +0300
Subject: [PATCH] [FIX] libcamhal: Fix TOCTOU and UNINIT Coverity defects

Changes:
- Fix CID 8502504 (TOCTOU): Ensure safe buffer size and explicit
  null-termination on readlink in MediaControl::getDevnameFromSysfs
- Fix CID 8504454 (UNINIT): Initialize tagType to -1 in
  CameraSensorsParser::parseGenericStaticMetaData

Change-Id: Icb55fb8ebc8e0696aaf91fc4bed14102c1e513c7
Tracked-On: #JSWBALINUX-258
Signed-off-by: Amarnath Kumar, Deepak <deepak.amarnath.kumar@intel.com>
---
 src/platformdata/CameraSensorsParser.cpp | 2 +-
 src/v4l2/MediaControl.cpp                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/platformdata/CameraSensorsParser.cpp b/src/platformdata/CameraSensorsParser.cpp
index 4212ae49..791f9555 100644
--- a/src/platformdata/CameraSensorsParser.cpp
+++ b/src/platformdata/CameraSensorsParser.cpp
@@ -1106,7 +1106,7 @@ void CameraSensorsParser::updateNVMDir() {
 void CameraSensorsParser::parseGenericStaticMetaData(const Json::Value& node) {
     auto keyNames = node.getMemberNames();
     for (const auto& key : keyNames) {
-        int tagType;
+        int tagType = -1;
         auto name = key;
 
         if (mCurCam->mStaticMetadata.mStaticMetadataToType.count(name))
diff --git a/src/v4l2/MediaControl.cpp b/src/v4l2/MediaControl.cpp
index 807d4f4b..d62dcd0b 100644
--- a/src/v4l2/MediaControl.cpp
+++ b/src/v4l2/MediaControl.cpp
@@ -503,12 +503,12 @@ int MediaControl::getDevnameFromSysfs(MediaEntity* entity) {
         return -EINVAL;
     }
 
-    ret = readlink(sysName, target, MAX_TARGET_NAME);
+    ret = readlink(sysName, target, sizeof(target) - 1);
     if (ret <= 0) {
         LOGE("readlink sysName %s failed ret %d.", sysName, ret);
         return -EINVAL;
     }
-    target[MAX_TARGET_NAME - 1] = '\0';
+    target[ret] = '\0';
 
     char* d = strrchr(target, '/');
     if (!d) {