gitproxy/RTLPlayground
1
0
Fork 0
mirror of https://github.com/logicog/RTLPlayground.git synced 2026-08-30 14:52:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix two OOB reads in parse_vlan()

Browse Source 
1. While loop scanning VLAN name terminated only on ' ', not '\0'.
   When the name is the last token in cmd_buffer, the loop reads past
   the buffer into adjacent XRAM.

2. Entering 'vlan' without arguments causes parse_vlan() to read
   cmd_words_b[1] which points to undefined memory, causing atoi_short()
   to interpret residual bytes from previous commands as a VLAN ID.
   Bug found and fix proposed by logicog during review of PR #232.

Co-Authored-By: logicog <logicog@users.noreply.github.com>
This commit is contained in:
Erdnusschokolade
2026-05-23 11:19:42 +02:00
co-authored by logicog
parent 21f33abfa7
commit 7d0d8525d2
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd_parser.c
+3 -1
View File
@@ -331,6 +331,8 @@ void parse_vlan(void)
vlan_settings.vlan = 0; vlan_settings.vlan = 0;
vlan_settings.members = 0; vlan_settings.members = 0;
vlan_settings.tagged = 0; vlan_settings.tagged = 0;
if (cmd_words_len < 2)
goto err;
if (!atoi_short(&vlan_settings.vlan, cmd_words_b[1])) { if (!atoi_short(&vlan_settings.vlan, cmd_words_b[1])) {
if (cmd_words_len == 3 && cmd_buffer[cmd_words_b[2]] == 'd') { if (cmd_words_len == 3 && cmd_buffer[cmd_words_b[2]] == 'd') {
vlan_delete(vlan_settings.vlan); vlan_delete(vlan_settings.vlan);
@@ -351,7 +353,7 @@ void parse_vlan(void)
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 8) & 0xf]; vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 8) & 0xf];
vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 4) & 0xf] ; vlan_names[vlan_ptr++] = hex[(vlan_settings.vlan >> 4) & 0xf] ;
vlan_names[vlan_ptr++] = hex[vlan_settings.vlan & 0xf]; vlan_names[vlan_ptr++] = hex[vlan_settings.vlan & 0xf];
while(cmd_buffer[cmd_words_b[w] + i] != ' ') { while(cmd_buffer[cmd_words_b[w] + i] != ' ' && cmd_buffer[cmd_words_b[w] + i] != '\0') {
write_char(cmd_buffer[cmd_words_b[w] + i]); write_char(cmd_buffer[cmd_words_b[w] + i]);
vlan_names[vlan_ptr++] = cmd_buffer[cmd_words_b[w] + i++]; vlan_names[vlan_ptr++] = cmd_buffer[cmd_words_b[w] + i++];
} }