Skip to content

Commit f908d0b

Browse files
rluboskartben
authored andcommitted
net: shell: Verify array index during dynamic iface completion
Verify that the interface index, converted to array index, does not exceed the preallocated string array for dynamic index completion. Signed-off-by: Robert Lubos <[email protected]>
1 parent 852a1e8 commit f908d0b

File tree

1 file changed

+17
-5
lines changed

1 file changed

+17
-5
lines changed

subsys/net/lib/shell/iface_dynamic.h

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ SHELL_DYNAMIC_CMD_CREATE(iface_index, iface_index_get);
2222
static char *set_iface_index_buffer(size_t idx)
2323
{
2424
struct net_if *iface = net_if_get_by_index(idx);
25+
size_t array_idx;
2526

2627
/* Network interfaces start at 1 */
2728
if (idx == 0) {
@@ -32,14 +33,20 @@ static char *set_iface_index_buffer(size_t idx)
3233
return NULL;
3334
}
3435

35-
snprintk(iface_index_buffer[idx - 1], MAX_IFACE_STR_LEN, "%d", (uint8_t)idx);
36+
array_idx = idx - 1;
37+
if (array_idx >= ARRAY_SIZE(iface_index_buffer)) {
38+
return NULL;
39+
}
40+
41+
snprintk(iface_index_buffer[array_idx], MAX_IFACE_STR_LEN, "%d", (uint8_t)idx);
3642

37-
return iface_index_buffer[idx - 1];
43+
return iface_index_buffer[array_idx];
3844
}
3945

4046
static char *set_iface_index_help(size_t idx)
4147
{
4248
struct net_if *iface = net_if_get_by_index(idx);
49+
size_t array_idx;
4350

4451
/* Network interfaces start at 1 */
4552
if (idx == 0) {
@@ -50,20 +57,25 @@ static char *set_iface_index_help(size_t idx)
5057
return NULL;
5158
}
5259

60+
array_idx = idx - 1;
61+
if (array_idx >= ARRAY_SIZE(iface_help_buffer)) {
62+
return NULL;
63+
}
64+
5365
#if defined(CONFIG_NET_INTERFACE_NAME)
5466
char name[CONFIG_NET_INTERFACE_NAME_LEN + 1];
5567

5668
net_if_get_name(iface, name, CONFIG_NET_INTERFACE_NAME_LEN);
5769
name[CONFIG_NET_INTERFACE_NAME_LEN] = '\0';
5870

59-
snprintk(iface_help_buffer[idx - 1], MAX_IFACE_HELP_STR_LEN,
71+
snprintk(iface_help_buffer[array_idx], MAX_IFACE_HELP_STR_LEN,
6072
"%s [%s] (%p)", name, iface2str(iface, NULL), iface);
6173
#else
62-
snprintk(iface_help_buffer[idx - 1], MAX_IFACE_HELP_STR_LEN,
74+
snprintk(iface_help_buffer[array_idx], MAX_IFACE_HELP_STR_LEN,
6375
"[%s] (%p)", iface2str(iface, NULL), iface);
6476
#endif
6577

66-
return iface_help_buffer[idx - 1];
78+
return iface_help_buffer[array_idx];
6779
}
6880

6981
static void iface_index_get(size_t idx, struct shell_static_entry *entry)

0 commit comments

Comments
 (0)