This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-core.git
commit daaf68fb70a22f21bd5536484d1cc4b4a4c5d669 Author: Szymon Janc <[email protected]> AuthorDate: Tue Oct 6 19:02:23 2026 +0200 sys/shell: Fix missing argv NULL termination in shell bridge Shell commands expect argv to be NULL terminated (POSIX style, as done by line2argv() for console input), but shell_bridge_exec() passed argv decoded from SMP request without terminating it. This resulted in commands reading uninitialized stack memory, e.g. "stat" command executed over SMP without arguments (newtmgr shell exec stat) crashed when dereferencing argv[1]. Assisted-by: Claude:claude-opus-5-5 --- sys/shell/src/shell_bridge.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sys/shell/src/shell_bridge.c b/sys/shell/src/shell_bridge.c index ff5304c91..5255317df 100644 --- a/sys/shell/src/shell_bridge.c +++ b/sys/shell/src/shell_bridge.c @@ -49,7 +49,7 @@ static int shell_bridge_exec(struct mgmt_ctxt *cb) { char line[MYNEWT_VAL(SHELL_BRIDGE_MAX_IN_LEN)]; - char *argv[MYNEWT_VAL(SHELL_CMD_ARGC_MAX)]; + char *argv[MYNEWT_VAL(SHELL_CMD_ARGC_MAX) + 1]; struct shell_bridge_streamer sbs; CborEncoder str_encoder; CborError err; @@ -66,7 +66,7 @@ shell_bridge_exec(struct mgmt_ctxt *cb) .arr.strings.store = line, .arr.strings.storelen = sizeof line, .count = &argc, - .maxlen = sizeof argv / sizeof argv[0], + .maxlen = MYNEWT_VAL(SHELL_CMD_ARGC_MAX), }, }, { 0 }, @@ -77,6 +77,9 @@ shell_bridge_exec(struct mgmt_ctxt *cb) return MGMT_ERR_EINVAL; } + /* Shell commands expect argv to be NULL terminated */ + argv[argc] = NULL; + /* Key="o"; value=<command-output> */ err |= cbor_encode_text_stringz(&cb->encoder, "o"); err |= cbor_encoder_create_indef_text_string(&cb->encoder, &str_encoder);
