adafruit-mirror/zephyr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 9

wifi: shell: btm_query: Fix invalid pointer cast

Browse source 
The 11v_btm_query shell command was calling parse_number() using
a pointer to uint8_t. This will cause memory overwrite and possible
crash. Convert to use long temporary value to avoid this.

Fix also the output prints in case of an error.

Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
This commit is contained in:
Jukka Rissanen 2024-10-09 15:32:58 +03:00 committed by Anas Nashif
parent 8105f70d7a
commit c6aa9e3803
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
subsys/net/l2/wifi/wifi_shell.c
View file

@ -1671,16 +1671,19 @@ static int cmd_wifi_btm_query(const struct shell *sh, size_t argc, char *argv[])
{ {
struct net_if *iface = net_if_get_first_wifi(); struct net_if *iface = net_if_get_first_wifi();
uint8_t query_reason = 0; uint8_t query_reason = 0;
long tmp = 0;
context.sh = sh; context.sh = sh;
if (!parse_number(sh, (long *)&query_reason, argv[1], NULL, if (!parse_number(sh, &tmp, argv[1], NULL,
WIFI_BTM_QUERY_REASON_UNSPECIFIED, WIFI_BTM_QUERY_REASON_LEAVING_ESS)) { WIFI_BTM_QUERY_REASON_UNSPECIFIED, WIFI_BTM_QUERY_REASON_LEAVING_ESS)) {
return -EINVAL; return -EINVAL;
} }
query_reason = tmp;
if (net_mgmt(NET_REQUEST_WIFI_BTM_QUERY, iface, &query_reason, sizeof(query_reason))) { if (net_mgmt(NET_REQUEST_WIFI_BTM_QUERY, iface, &query_reason, sizeof(query_reason))) {
PR_WARNING("Setting BTM query Reason failed..Reason :%d\n", query_reason); PR_WARNING("Setting BTM query Reason failed. Reason : %d\n", query_reason);
return -ENOEXEC; return -ENOEXEC;
} }