shell: utils: Fix buffer overrun in shell_spaces_trim #23304
Conversation
The third argument in memmove can possible be greater than remaining buffer size. Just ensuring that memmove will changes bytes only inside the string buffer and nothing else. Signed-off-by: Flavio Ceolin <[email protected]>
ceolin
added
area: Shell
|
May you please elaborate on how this can happen? Any example? |
|
I'll wait for a review from a shell subsystem maintainer before merging |
Consider a long string which ends with two spaces followed by a non-space character. When the function calls memmove, the first and second arguments would point near the end of the string, while shift would be equal to 2. The third argument then ends up equal to the length of the string minus 3, which when added to either pointer results in a address that is located outside of the string buffer. |
|
@ceolin didn't want to push directly to your branch but i wrote the test to confirm the bug. Feel free to cherry-pick it into that PR: nordic-krch@abe8b15 |
The third argument in memmove can possible be greater than remaining
buffer size. Just ensuring that memmove will changes bytes only inside
the string buffer and nothing else.
Signed-off-by: Flavio Ceolin [email protected]