[PATCH 3/5] shell/shell.c: Fix illegal string copy
Frank Kuehndel
frank.kuehndel at embedded-brains.de
Tue Oct 13 13:48:57 UTC 2020
From: Frank Kühndel <frank.kuehndel at embedded-brains.de>
This is an illegal use of strcpy() because one is not allowed to
use this function with overlapping source and destination buffers;
whereas memmove() is explicitly designed to handle such cases.
The copiler warning was:
../../../cpukit/libmisc/shell/shell.c:626:13: warning:
'strcpy' accessing between 1 and 2147483645 bytes at offsets
0 and [1, 2147483647] may overlap up to 2147483644 bytes at
offset [1, 2147483644] [-Wrestrict]
---
cpukit/libmisc/shell/shell.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/cpukit/libmisc/shell/shell.c b/cpukit/libmisc/shell/shell.c
index c5fc1f5c48..1a3b438b37 100644
--- a/cpukit/libmisc/shell/shell.c
+++ b/cpukit/libmisc/shell/shell.c
@@ -287,6 +287,16 @@ void rtems_shell_dup_current_env(rtems_shell_env_t *copy)
copy->managed = false;
}
+/*
+ * Move a string in a buffer to the left (e.g. when a character
+ * is deleted). The string must be NUL-terminated and the
+ * NUL-character will be moved too.
+ */
+static void rtems_shell_move_left( char *start, size_t offset )
+{
+ memmove(start, start + offset, strlen(start + offset) + 1);
+}
+
/*
* Get a line of user input with modest features
*/
@@ -393,7 +403,7 @@ static int rtems_shell_line_editor(
{
int end;
int bs;
- strcpy (&line[col], &line[col + 1]);
+ rtems_shell_move_left(line + col, 1);
if (output) {
fprintf(out,"\r%s%s ", prompt, line);
end = (int) strlen (line);
@@ -432,7 +442,7 @@ static int rtems_shell_line_editor(
case 4: /* Control-D */
if (strlen(line)) {
if (col < strlen(line)) {
- strcpy (line + col, line + col + 1);
+ rtems_shell_move_left(line + col, 1);
if (output) {
int bs;
fprintf(out,"%s \b", line + col);
@@ -508,7 +518,7 @@ static int rtems_shell_line_editor(
{
int bs;
col--;
- strcpy (line + col, line + col + 1);
+ rtems_shell_move_left(line + col, 1);
if (output) {
fprintf(out,"\b%s \b", line + col);
for (bs = 0; bs < ((int) strlen (line) - col); bs++)
@@ -625,7 +635,7 @@ static int rtems_shell_line_editor(
int clen = (int) strlen (line);
int bs;
- strcpy (line, line + col);
+ rtems_shell_move_left(line, col);
if (output) {
fprintf(out,"\r%s%*c", prompt, clen, ' ');
fprintf(out,"\r%s%s", prompt, line);
--
2.26.2
More information about the devel
mailing list