Merge pull request #413 from DrDoof/fix/vlan-name-bounds

vlan: bound the name table before writing into it
This commit is contained in:
René van Dorst authored and GitHub committed 2026-09-09 08:47:05 +02:00
commit 3f65db9984
1 file changed
+19 -9
+19 -9
View File
@@ -504,20 +504,30 @@ void parse_vlan(void)
}
uint8_t w = 2;
if (cmd_words_len > w && isletter(cmd_buffer[cmd_words_b[w]])) {
uint8_t pos = cmd_words_b[w];
if (cmd_words_len > w && isletter(cmd_buffer[pos])) {
uint8_t i = 0;
while (!cmd_is_space_or_nul(pos + i))
i++;
if (vlan_ptr + i > (VLAN_NAMES_SIZE - 5)) {
print_string("VLAN name table full, name ignored\n");
} else {
vlan_name_remove(vlan_settings.vlan);
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 8) & 0xf];
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 4) & 0xf] ;
vlan_names[vlan_ptr++] = hex[vlan_settings.vlan & 0xf];
while(!cmd_is_space_or_nul(cmd_words_b[w] + i)) {
write_char(cmd_buffer[cmd_words_b[w] + i]);
vlan_names[vlan_ptr++] = cmd_buffer[cmd_words_b[w] + i++];
__xdata uint8_t *vlan_str = &vlan_names[vlan_ptr];
*vlan_str++ = hex[(vlan_settings.vlan >> 8) & 0xf];
*vlan_str++ = hex[(vlan_settings.vlan >> 4) & 0xf] ;
*vlan_str++ = hex[vlan_settings.vlan & 0xf];
while(!cmd_is_space_or_nul(pos)) {
uint8_t c = cmd_buffer[pos++];
write_char(c);
*vlan_str++ = c;
}
vlan_names[vlan_ptr++] = ' '; vlan_names[vlan_ptr] = NUL;
w++;
*vlan_str++ = ' '; *vlan_str = NUL;
vlan_ptr = vlan_str - vlan_names;
print_string("<\n");
}
w++;
}
uint8_t ret;
uint8_t idx;