sergiotarxz/nuttx-apps
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

nsh: Fix a buffer overflow in help

Browse Source 
Introduced by https://github.com/apache/nuttx-apps/pull/1610,
internal line buffer should have more bytes for tab before newline and '\0'.

Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
This commit is contained in:
Huang Qi 2023-03-05 09:07:36 +08:00 committed by Petro Karashchenko
parent 509e90aadc
commit 12d31075eb
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nshlib/nsh_command.c
View File

@ -45,6 +45,7 @@
/* Help command summary layout */ /* Help command summary layout */
#define HELP_LINELEN 80 #define HELP_LINELEN 80
#define HELP_TABSIZE 4
#define NUM_CMDS ((sizeof(g_cmdmap)/sizeof(struct cmdmap_s)) - 1) #define NUM_CMDS ((sizeof(g_cmdmap)/sizeof(struct cmdmap_s)) - 1)
/**************************************************************************** /****************************************************************************
@ -616,7 +617,10 @@ static inline void help_cmdlist(FAR struct nsh_vtbl_s *vtbl)
unsigned int j; unsigned int j;
unsigned int k; unsigned int k;
unsigned int offset; unsigned int offset;
char line[HELP_LINELEN];
/* Extra 5 bytes for tab before newline and '\0' */
char line[HELP_LINELEN + HELP_TABSIZE + 1];
/* Pick an optimal column width */ /* Pick an optimal column width */
@ -654,7 +658,7 @@ static inline void help_cmdlist(FAR struct nsh_vtbl_s *vtbl)
{ {
/* Tab before a new line */ /* Tab before a new line */
offset = 4; offset = HELP_TABSIZE;
memset(line, ' ', offset); memset(line, ' ', offset);
for (j = 0, k = i; for (j = 0, k = i;