diff options
| author | Old-Ding <[email protected]> | 2026-07-06 07:36:17 +0800 |
|---|---|---|
| committer | Rbb666 <[email protected]> | 2026-07-08 13:37:21 +0800 |
| commit | 221502ade053e5e9142da8a6b2c0f91f32e356b4 (patch) | |
| tree | 3335b5ec28e279ba8e9e68b6bfd5d882668cca39 | |
| parent | b9550aad85cfedbad660a1d948417fa93be85163 (diff) | |
components: finsh: check token bounds before access
Move the command length checks before reading command buffers while parsing module, script, and LWP command names. This keeps commands without separators from reading one byte past the provided length.
Generated-by: OpenAI Codex
Signed-off-by: Old-Ding <[email protected]>
| -rw-r--r-- | components/finsh/msh.c | 4 | ||||
| -rw-r--r-- | components/finsh/msh_file.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/components/finsh/msh.c b/components/finsh/msh.c index 6d8b7c78de..04ac8e73c1 100644 --- a/components/finsh/msh.c +++ b/components/finsh/msh.c @@ -262,7 +262,7 @@ int msh_exec_module(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */ @@ -487,7 +487,7 @@ int _msh_exec_lwp(int debug, char *cmd, rt_size_t length) int ret; /* find the size of first command */ - while ((cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') && cmd0_size < length) + while (cmd0_size < length && cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') cmd0_size ++; if (cmd0_size == 0) return -1; diff --git a/components/finsh/msh_file.c b/components/finsh/msh_file.c index cc67fe94d8..efcabee225 100644 --- a/components/finsh/msh_file.c +++ b/components/finsh/msh_file.c @@ -76,7 +76,7 @@ int msh_exec_script(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */ |