rpcd, branch master

file: re-authorize ACL against resolved path to close symlink bypass

2026-07-19T12:57:18Z

The file plugin matched ACL grants against the textual, canonicalized path but then let open()/stat()/opendir() follow symlinks unchecked. A symlink placed inside an ACL-covered directory therefore let a grant on the link authorize read/write/list/stat access to whatever file it pointed to, including files entirely outside the granted scope. Re-resolve the path with realpath() and re-run the ACL check against the resolved target whenever it differs from the canonicalized string, for every operation that dereferences the final component (read, write, md5, list, stat). lstat and remove are left untouched since they either need to see the link itself or already handle it safely via unlink()'s no-follow semantics. Newly created files (file.write) and dangling symlinks pointing outside the granted scope are handled via the containing directory. Also mask file.write's mode parameter to 0777 and drop the local umask(0) override, and authorize recursive file.remove per-entry instead of only at the top-level path. Fixes GHSA-q5gr-86pq-vvwr. Signed-off-by: Jo-Philipp Wich

cast char arguments to unsigned char for ctype.h functions

2026-06-03T23:20:50Z

isspace()/isxdigit()/isalnum()/tolower() are only defined for arguments representable as unsigned char or EOF. Several call sites passed a plain (signed) char taken from client- or file-controlled data (uci names, the session id, apk db lines, ACL list entries); a byte >= 0x80 sign-extends to a negative int, which is undefined behaviour and can index out of bounds of a ctype lookup table on some C libraries. Cast the argument to unsigned char at each site. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

iwinfo: fix error handling and backend leak in survey

2026-06-03T23:20:46Z

rpc_iwinfo_survey() opened the iwinfo backend and the "results" blob array, then on any error (open failed, survey call failed, negative length) did "return UBUS_STATUS_OK" without sending a reply and without calling rpc_iwinfo_close(). That leaked the iwinfo backend until the next iwinfo call, abandoned a half-built reply, and masked an open failure as success. Restructure it like the freqlist/txpowerlist/countrylist handlers: return the open error directly, otherwise emit the (possibly empty) results array, send the reply and always release the backend. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

ucode: bound recursion when converting blob arguments to ucode values

2026-06-03T23:20:41Z

rpc_ucode_blob_array_to_ucv()/rpc_ucode_blob_to_ucv() recurse once per nesting level of the incoming request message, which is fully attacker controlled. ubus permits messages up to UBUS_MAX_MSGLEN (1 MiB) and libubox enforces no nesting limit, so a deeply nested array/table argument to a ucode plugin method can drive tens of thousands of recursion levels and overflow the stack, crashing rpcd. Thread a depth counter through the conversion and stop descending past RPC_UCODE_MAX_NESTING (32) levels, which is far beyond any legitimate ubus message. Over-deep subtrees become null values instead of crashing. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

file: avoid zero-length b64_decode() on empty write data

2026-06-03T23:20:36Z

rpc_file_write() computes data_len as blobmsg_data_len() - 1, which is 0 for an empty "data" string. With base64 enabled it then called b64_decode(data, data, 0); b64_decode() asserts dest size > 0, so a request like file.write {"data":"","base64":true} aborts the daemon when libubox is built with assertions enabled (and is a pointless call otherwise). Skip the decode when there is no data; the file is still created/ truncated and zero bytes are written, which is the correct result. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS

2026-06-03T23:20:31Z

The /etc/apk/world parser depends on a NUL byte one past the file contents (world buffer is sized st_size + 1) to terminate its string scans, and the world[] pointer walk and is_all_or_world() dereference a sentinel that points at that trailing byte. The file was mapped with mmap(st_size + 1); when the file size is an exact multiple of the page size, the byte at offset st_size lies in a page entirely beyond EOF and accessing it raises SIGBUS, crashing the daemon. Read the file into a malloc'd buffer and NUL terminate it explicitly so the terminator is always backed by real memory. This also drops the now unused include. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rpc-sys: packagelist: close status file on world parsing error paths

2026-06-03T23:20:26Z

rpc_sys_packagelist() opens /lib/apk/db/installed and then, for the non-"all" case, opens and parses /etc/apk/world. Every early error return in that parsing block (missing world file, fstat failure, empty or newline-less world, mmap failure) returned without fclose()ing the already open status file, leaking a FILE/descriptor on each call. The most easily triggered case is a system whose installed db exists but that has no /etc/apk/world. Close the status file on all of these error paths. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rc: reap killed child on list "running" check timeout

2026-06-03T23:20:21Z

When a script's "running" check exceeds RC_LIST_EXEC_TIMEOUT_MS, rpc_list_exec_timeout_cb() removes the process from uloop and SIGKILLs it, but never waits on it. Since uloop_process_delete() stops uloop from reaping the child, it is left as a zombie for the lifetime of the daemon. Add a waitpid() after the kill to reap the just-killed child. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

treat exec failures in forked children with _exit() instead of return

2026-06-03T23:20:16Z

Several handlers fork and, in the child, fall back to "return " when open()/malloc()/execv() etc. fail. Returning a ubus status code from the child does not terminate it: control unwinds back into the ubus dispatch loop and the child keeps running as a duplicate rpcd, racing the parent on the ubus socket and pipes. Replace these child-side returns with _exit(127) so a child that cannot exec the target simply terminates, which is also what the parent's WEXITSTATUS based reporting expects. Affected paths: exec.c (rpc_exec), file.c (rpc_file_exec_run), sys.c (rpc_cgi_password_set) and plugin.c (rpc_plugin_register_exec). Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens

rc: use a per-request blob_buf for the list reply

2026-06-03T23:20:12Z

rc_list() built the reply in a function-local "static struct blob_buf", shared by every invocation, and kept using it across the deferred, asynchronous directory walk. Two overlapping "rc list" requests (the walk waits on forked children, so a second request is easily interleaved) would both blob_buf_init() and append to the same buffer, corrupting each other's reply or crashing. Move the blob_buf into the per-request context so each request owns its own buffer, and free it when the request completes. Assisted-by: Claude:claude-opus-4-8 Link: https://github.com/openwrt/rpcd/pull/34 Signed-off-by: Hauke Mehrtens