Skip to content

Commit

Permalink
drivers: eswifi: shell: Fix possible overflow
Browse files Browse the repository at this point in the history
Limit the copied data to the buffer's size.

Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
  • Loading branch information
Flavio Ceolin authored and carlescufi committed Oct 10, 2023
1 parent 2504329 commit ea109f6
Showing 1 changed file with 10 additions and 2 deletions.
12 changes: 10 additions & 2 deletions drivers/wifi/eswifi/eswifi_shell.c
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ static int eswifi_shell_atcmd(const struct shell *sh, size_t argc,
char **argv)
{
int i;
size_t len = 0;

if (eswifi == NULL) {
shell_print(sh, "no eswifi device registered");
Expand All @@ -40,9 +41,16 @@ static int eswifi_shell_atcmd(const struct shell *sh, size_t argc,

memset(eswifi->buf, 0, sizeof(eswifi->buf));
for (i = 1; i < argc; i++) {
strcat(eswifi->buf, argv[i]);
size_t argv_len = strlen(argv[i]);

if ((len + argv_len) >= sizeof(eswifi->buf) - 1) {
break;
}

memcpy(eswifi->buf + len, argv[i], argv_len);
len += argv_len;
}
strcat(eswifi->buf, "\r");
eswifi->buf[len] = '\r';

shell_print(sh, "> %s", eswifi->buf);
eswifi_at_cmd(eswifi, eswifi->buf);
Expand Down

0 comments on commit ea109f6

Please sign in to comment.