Merge pull request #413 from DrDoof/fix/vlan-name-bounds

vlan: bound the name table before writing into it
This commit is contained in:
René van Dorst authored and GitHub committed 2026-09-09 08:47:05 +02:00
commit 3f65db9984
1 file changed
+20 -10
+20 -10
View File
@@ -504,19 +504,29 @@ void parse_vlan(void)
} }
uint8_t w = 2; uint8_t w = 2;
if (cmd_words_len > w && isletter(cmd_buffer[cmd_words_b[w]])) { uint8_t pos = cmd_words_b[w];
if (cmd_words_len > w && isletter(cmd_buffer[pos])) {
uint8_t i = 0; uint8_t i = 0;
vlan_name_remove(vlan_settings.vlan); while (!cmd_is_space_or_nul(pos + i))
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 8) & 0xf]; i++;
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 4) & 0xf] ; if (vlan_ptr + i > (VLAN_NAMES_SIZE - 5)) {
vlan_names[vlan_ptr++] = hex[vlan_settings.vlan & 0xf]; print_string("VLAN name table full, name ignored\n");
while(!cmd_is_space_or_nul(cmd_words_b[w] + i)) { } else {
write_char(cmd_buffer[cmd_words_b[w] + i]); vlan_name_remove(vlan_settings.vlan);
vlan_names[vlan_ptr++] = cmd_buffer[cmd_words_b[w] + i++]; __xdata uint8_t *vlan_str = &vlan_names[vlan_ptr];
*vlan_str++ = hex[(vlan_settings.vlan >> 8) & 0xf];
*vlan_str++ = hex[(vlan_settings.vlan >> 4) & 0xf] ;
*vlan_str++ = hex[vlan_settings.vlan & 0xf];
while(!cmd_is_space_or_nul(pos)) {
uint8_t c = cmd_buffer[pos++];
write_char(c);
*vlan_str++ = c;
}
*vlan_str++ = ' '; *vlan_str = NUL;
vlan_ptr = vlan_str - vlan_names;
print_string("<\n");
} }
vlan_names[vlan_ptr++] = ' '; vlan_names[vlan_ptr] = NUL;
w++; w++;
print_string("<\n");
} }
uint8_t ret; uint8_t ret;