commit 69d50db53aab595b17526013a06ad5d9f575346c
author Jakub Rzeszutko <jakub.rzeszutko@verkada.com> Fri Oct 13 09:50:17 2023 +0200
committer Johan Hedberg <johan.hedberg@gmail.com> Fri Oct 13 13:11:28 2023 +0300
tree 3d59a094653d2756ab7e80c074c27bb8bb9f632e
parent 4b5331ba45b037f0e5a791da96b533d5c7253fc7

shell: fix a memory corruption coverity issue

Added a condition to check if the size of the copied
memory is a positive number.

Fixes #58700
Fixes #58703

Signed-off-by: Jakub Rzeszutko <jakub.rzeszutko@verkada.com>

subsys/shell/shell_log_backend.c

diff --git a/subsys/shell/shell_log_backend.c b/subsys/shell/shell_log_backend.c
index 2a90478..38ee97c 100644
--- a/subsys/shell/shell_log_backend.c
+++ b/subsys/shell/shell_log_backend.c
@@ -143,6 +143,9 @@
 	uint8_t *src_data = (uint8_t *)msg + sizeof(struct mpsc_pbuf_hdr);
 	size_t hdr_wlen = DIV_ROUND_UP(sizeof(struct mpsc_pbuf_hdr),
 					   sizeof(uint32_t));
+	if (wlen <= hdr_wlen) {
+		return false;
+	}
 
 	dst->hdr.data = msg->buf.hdr.data;
 	memcpy(dst_data, src_data, (wlen - hdr_wlen) * sizeof(uint32_t));