From 7d0d8525d29048a0ddc34ca1f7281b6bf1043f8e Mon Sep 17 00:00:00 2001 From: Erdnusschokolade <96622762+Erdnusschokolade@users.noreply.github.com> Date: Sat, 23 May 2026 11:19:42 +0200 Subject: [PATCH] Fix two OOB reads in parse_vlan() 1. While loop scanning VLAN name terminated only on ' ', not '\0'. When the name is the last token in cmd_buffer, the loop reads past the buffer into adjacent XRAM. 2. Entering 'vlan' without arguments causes parse_vlan() to read cmd_words_b[1] which points to undefined memory, causing atoi_short() to interpret residual bytes from previous commands as a VLAN ID. Bug found and fix proposed by logicog during review of PR #232. Co-Authored-By: logicog --- cmd_parser.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cmd_parser.c b/cmd_parser.c index 7f4004a..ba9ceb3 100644 --- a/cmd_parser.c +++ b/cmd_parser.c @@ -331,6 +331,8 @@ void parse_vlan(void) vlan_settings.vlan = 0; vlan_settings.members = 0; vlan_settings.tagged = 0; + if (cmd_words_len < 2) + goto err; if (!atoi_short(&vlan_settings.vlan, cmd_words_b[1])) { if (cmd_words_len == 3 && cmd_buffer[cmd_words_b[2]] == 'd') { vlan_delete(vlan_settings.vlan); @@ -351,7 +353,7 @@ void parse_vlan(void) vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 8) & 0xf]; vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 4) & 0xf] ; vlan_names[vlan_ptr++] = hex[vlan_settings.vlan & 0xf]; - while(cmd_buffer[cmd_words_b[w] + i] != ' ') { + while(cmd_buffer[cmd_words_b[w] + i] != ' ' && cmd_buffer[cmd_words_b[w] + i] != '\0') { write_char(cmd_buffer[cmd_words_b[w] + i]); vlan_names[vlan_ptr++] = cmd_buffer[cmd_words_b[w] + i++]; }