vlan: reject VLAN IDs the table cannot hold

vlan_create() and vlan_delete() wrote the ID straight into the table index
register. vlan_get() has refused anything >= 0xfff for a while, so reads were
guarded and writes were not: "vlan 4095 1 2" built an entry that no read path
can see, and IDs above that either miss the table or alias onto another VLAN.

Both writers now enforce the range vlan_get() already did, and parse_vlan()
rejects the same values with the usage message so the CLI says why. The check
sits after the "vlan 0 mgmt" branch, which legitimately takes 0 to switch the
management VLAN off.

Costs nothing in RAM: rtl837x_port.rel stays at DSEG 0, OSEG 5, and the image
still reports 10207 bytes of XDATA in use.
This commit is contained in:
d00f
2026-08-08 17:13:28 +02:00
parent 6254f44001
commit 10d472d8a6
2 changed files with 10 additions and 0 deletions
+2
View File
@@ -354,6 +354,8 @@ void parse_vlan(void)
print_string("Management VLAN set to "); print_short(management_vlan); write_char('\n');
return;
}
if (!vlan_settings.vlan || vlan_settings.vlan > 4094)
goto err;
uint8_t w = 2;
if (cmd_words_len > w && isletter(cmd_buffer[cmd_words_b[w]])) {
register uint8_t i = 0;