components: finsh: check token bounds before access#11564
Conversation
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: componentsReviewers: @Maihuanyi Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-07-06 09:05 CST)
📝 Review Instructions
|
|
Move the command length checks before reading command buffers while parsing module, script, and LWP command names. This keeps commands without separators from reading one byte past the provided length. Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com>
Old-Ding
force-pushed
the
codex/msh-token-bound-check
branch
from
7e449a1 to
c8e4aec
Compare
|
lgtm |
2 participants
Summary\n- check command buffer bounds before reading the current character in module command parsing\n- apply the same ordering to script and LWP command parsing, matching the safer pattern already used by msh_exec_cmd()\n\n## Verification\n- git diff --check HEAD^ HEAD -- components/finsh/msh.c components/finsh/msh_file.c\n- git show --stat --check --format=fuller HEAD\n- git ls-files --eol -- components/finsh/msh.c components/finsh/msh_file.c\n- git grep -n -P -e 'while \(\([^)]cmd(?:_line)?\[[^]]+\].&& [^)]< (?:length|size)\)' -- '.c' '*.h'