From c8e4aec0f034669596e5f5d4c35b44e930cc167b Mon Sep 17 00:00:00 2001 From: Old-Ding <35417409+Old-Ding@users.noreply.github.com> Date: Mon, 6 Jul 2026 07:36:17 +0800 Subject: [PATCH] components: finsh: check token bounds before access Move the command length checks before reading command buffers while parsing module, script, and LWP command names. This keeps commands without separators from reading one byte past the provided length. Generated-by: OpenAI Codex Signed-off-by: Old-Ding <35417409+Old-Ding@users.noreply.github.com> --- components/finsh/msh.c | 4 ++-- components/finsh/msh_file.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/components/finsh/msh.c b/components/finsh/msh.c index 6d8b7c78de8..04ac8e73c1e 100644 --- a/components/finsh/msh.c +++ b/components/finsh/msh.c @@ -262,7 +262,7 @@ int msh_exec_module(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */ @@ -487,7 +487,7 @@ int _msh_exec_lwp(int debug, char *cmd, rt_size_t length) int ret; /* find the size of first command */ - while ((cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') && cmd0_size < length) + while (cmd0_size < length && cmd[cmd0_size] != ' ' && cmd[cmd0_size] != '\t') cmd0_size ++; if (cmd0_size == 0) return -1; diff --git a/components/finsh/msh_file.c b/components/finsh/msh_file.c index cc67fe94d85..efcabee225f 100644 --- a/components/finsh/msh_file.c +++ b/components/finsh/msh_file.c @@ -76,7 +76,7 @@ int msh_exec_script(const char *cmd_line, int size) if (size == 0) return -RT_ERROR; /* get the length of command0 */ - while ((cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') && cmd_length < size) + while (cmd_length < size && cmd_line[cmd_length] != ' ' && cmd_line[cmd_length] != '\t') cmd_length ++; /* get name length */