From 056a30ab3d36c0d437a6b9aa5c4baf34a8ffc5ee Mon Sep 17 00:00:00 2001 From: d00f Date: Tue, 4 Aug 2026 05:07:03 +0200 Subject: [PATCH] cmd: reject out-of-range byte arguments instead of wrapping atoi_byte() accumulated into a uint8_t, so any argument above 255 wrapped silently: "stp failsafe 300" configured a 44-second watchdog, and a command whose range check happens to accept the wrapped value applied something the operator never asked for. Accumulate wider and report the overflow as a parse error, like a non-numeric argument. --- cmd_parser.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/cmd_parser.c b/cmd_parser.c index 6178f9a..b85d71e 100644 --- a/cmd_parser.c +++ b/cmd_parser.c @@ -188,15 +188,17 @@ uint8_t atoi_hex(uint8_t idx) uint8_t atoi_byte(__xdata uint8_t *out, uint8_t idx) { uint8_t err = 1; - uint8_t num = 0; + uint16_t num = 0; /* wider than the result: catch the overflow */ while (isnumber(cmd_buffer[idx])) { err = 0; num = (num * 10) + cmd_buffer[idx] - '0'; + if (num > 255) /* would silently wrap, e.g. 300 -> 44 */ + return 1; idx++; } - *out = num; + *out = (uint8_t)num; return err; }