From bce1d2bd2893ed927c6abaa19dc7b649a6703ebc Mon Sep 17 00:00:00 2001 From: d00f Date: Tue, 21 Jul 2026 09:25:21 +0200 Subject: [PATCH] stp: reject port sub-commands with a missing argument "stp port 7 edge" (no value) passed the cmd_words_len < 4 check and then cmd_compare(4, ...) read a stale word left over from the PREVIOUS command line - cmd_words_b is not cleared between commands - so the sub-command could randomly match whatever was typed before. Require 5 words for every per-port sub-command that carries an argument (everything except on/off). (cherry picked from commit 1210f4f9257b14c31ad653fc7616ef403a494d28) --- rtl837x_stp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/rtl837x_stp.c b/rtl837x_stp.c index 176f672..1627b9f 100644 --- a/rtl837x_stp.c +++ b/rtl837x_stp.c @@ -524,6 +524,11 @@ void stp_parse(void) __banked __reentrant goto err; { uint8_t port = machine.phys_to_log_port[stp_scratch - 1]; + /* every sub-command except on/off carries one more argument; without + * this check cmd_compare(4,..) would read a stale word from the + * PREVIOUS command line (cmd_words_b is not cleared between commands) */ + if (cmd_words_len < 5 && !cmd_compare(3, "on") && !cmd_compare(3, "off")) + goto err; if (cmd_compare(3, "on")) { stp_pflags[port] |= STP_PF_ENABLED; stp_pflags[port] &= ~STP_PF_TRIPPED;