From 221502ade053e5e9142da8a6b2c0f91f32e356b4 Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 07:36:17 +0800 Subject: [PATCH] components: finsh: check token bounds before access Move the command length checks before reading command buffers while parsing module, script, and LWP command names. This keeps commands without separators from reading one byte past the provided length. Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/finsh/msh.c | 4 ++-- components/finsh/msh_file.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/finsh/msh.c b/components/finsh/msh.c index 6d8b7c78de..04ac8e73c1 100644 --- a/components/finsh/msh.c +++ b/components/finsh/msh.c @@ -262,7 +262,7 @@ int msh_exec_module(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */ @@ -487,7 +487,7 @@ int _msh_exec_lwp(int debug, char *cmd, rt_size_t length) int ret; /* find the size of first command */ - while ((cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') && cmd0_size < length) + while (cmd0_size < length && cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') cmd0_size ++; if (cmd0_size == 0) return -1; diff --git a/components/finsh/msh_file.c b/components/finsh/msh_file.c index cc67fe94d8..efcabee225 100644 --- a/components/finsh/msh_file.c +++ b/components/finsh/msh_file.c @@ -76,7 +76,7 @@ int msh_exec_script(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */