From 153bb926fc86aaabd047c1ea8f2a18d4db2305ec Mon Sep 17 00:00:00 2001 From: Guillaume Souchere Date: Wed, 8 Jul 2026 08:50:28 +0200 Subject: [PATCH 1/2] fix(console): Fix security code review findings --- components/console/commands.c | 4 ++++ components/console/linenoise/linenoise.c | 21 ++++++++++++++++----- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/components/console/commands.c b/components/console/commands.c index b3bb082c6d3..be9aa3e39a5 100644 --- a/components/console/commands.c +++ b/components/console/commands.c @@ -134,6 +134,7 @@ esp_err_t esp_console_cmd_register(const esp_console_cmd_t *cmd) } else { // remove from list and free the old hint, because we will alloc new hint for the command esp_console_rm_item_free_hint(item); + item->hint = NULL; } item->command = cmd->command; item->help = cmd->help; @@ -382,8 +383,11 @@ esp_err_t esp_console_register_help_command(void) esp_err_t esp_console_deregister_help_command(void) { free(help_args.help_cmd); + help_args.help_cmd = NULL; free(help_args.verbose_level); + help_args.verbose_level = NULL; free(help_args.end); + help_args.end = NULL; return esp_console_cmd_deregister("help"); } diff --git a/components/console/linenoise/linenoise.c b/components/console/linenoise/linenoise.c index 64fcf23a12d..22554f253af 100644 --- a/components/console/linenoise/linenoise.c +++ b/components/console/linenoise/linenoise.c @@ -354,7 +354,7 @@ static int getColumns(void) { /* After sending this command, we can get the new position of the cursor, * we'd get the size, in columns, of the opened TTY. */ cols = getCursorPosition(); - if (cols == -1) { + if (cols <= 0) { goto failed; } @@ -565,6 +565,9 @@ void refreshShowHints(struct abuf *ab, struct linenoiseState *l, int plen) { * Rewrite the currently edited line accordingly to the buffer content, * cursor position, and number of columns of the terminal. */ static void refreshSingleLine(struct linenoiseState *l) { + if (l->cols == 0) { + l->cols = 80; + } char seq[64]; size_t plen = l->plen; int fd = fileno(stdout); @@ -607,6 +610,9 @@ static void refreshSingleLine(struct linenoiseState *l) { * Rewrite the currently edited line accordingly to the buffer content, * cursor position, and number of columns of the terminal. */ static void refreshMultiLine(struct linenoiseState *l) { + if (l->cols == 0) { + l->cols = 80; + } char seq[64]; int plen = l->plen; int rows = (plen+l->len+l->cols-1)/l->cols; /* rows used by current buf. */ @@ -891,6 +897,9 @@ static int linenoiseEdit(char *buf, size_t buflen, const char *prompt) l.oldpos = l.pos = 0; l.len = 0; l.cols = getColumns(); + if (l.cols == 0) { + l.cols = 80; + } l.maxrows = 0; l.history_index = 0; @@ -1171,14 +1180,15 @@ static int linenoiseDumb(char* buf, size_t buflen, const char* prompt) { flushWrite(); size_t count = 0; + int nread = 0; const int in_fd = fileno(stdin); char c = 'c'; - while (count < buflen) { + while (count + 1 < buflen) { - int nread = read_func(in_fd, &c, 1); + nread = read_func(in_fd, &c, 1); if (nread < 0) { - return nread; + break; } if (c == '\n') { break; @@ -1206,9 +1216,10 @@ static int linenoiseDumb(char* buf, size_t buflen, const char* prompt) { fputc(c, stdout); /* echo */ flushWrite(); } + buf[count] = '\0'; fputc('\n', stdout); flushWrite(); - return count; + return nread < 0 ? nread : (int)count; } static void sanitize(char* src) { From 44d0de155310ded458872b6b565266b2743227d4 Mon Sep 17 00:00:00 2001 From: Guillaume Souchere Date: Mon, 13 Jul 2026 08:38:26 +0200 Subject: [PATCH 2/2] fix(console): Clamp linenoise cols field to 80 if getColums returns less than that --- components/console/linenoise/linenoise.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/components/console/linenoise/linenoise.c b/components/console/linenoise/linenoise.c index 22554f253af..7328b04d3f4 100644 --- a/components/console/linenoise/linenoise.c +++ b/components/console/linenoise/linenoise.c @@ -138,6 +138,7 @@ __thread FILE *linenoise_stdout; #define LINENOISE_MINIMAL_MAX_LINE 64 #define LINENOISE_COMMAND_MAX_LEN 32 #define LINENOISE_PASTE_KEY_DELAY 30 /* Delay, in milliseconds, between two characters being pasted from clipboard */ +#define LINENOISE_DEFAULT_COLS 80 /* Minimum sensible terminal width; used as fallback */ static linenoiseCompletionCallback *completionCallback = NULL; static linenoiseHintsCallback *hintsCallback = NULL; @@ -565,8 +566,8 @@ void refreshShowHints(struct abuf *ab, struct linenoiseState *l, int plen) { * Rewrite the currently edited line accordingly to the buffer content, * cursor position, and number of columns of the terminal. */ static void refreshSingleLine(struct linenoiseState *l) { - if (l->cols == 0) { - l->cols = 80; + if (l->cols < LINENOISE_DEFAULT_COLS) { + l->cols = LINENOISE_DEFAULT_COLS; } char seq[64]; size_t plen = l->plen; @@ -610,8 +611,8 @@ static void refreshSingleLine(struct linenoiseState *l) { * Rewrite the currently edited line accordingly to the buffer content, * cursor position, and number of columns of the terminal. */ static void refreshMultiLine(struct linenoiseState *l) { - if (l->cols == 0) { - l->cols = 80; + if (l->cols < LINENOISE_DEFAULT_COLS) { + l->cols = LINENOISE_DEFAULT_COLS; } char seq[64]; int plen = l->plen; @@ -897,8 +898,8 @@ static int linenoiseEdit(char *buf, size_t buflen, const char *prompt) l.oldpos = l.pos = 0; l.len = 0; l.cols = getColumns(); - if (l.cols == 0) { - l.cols = 80; + if (l.cols < LINENOISE_DEFAULT_COLS) { + l.cols = LINENOISE_DEFAULT_COLS; } l.maxrows = 0; l.history_index = 0;