wifi: shell: btm_query: Fix invalid pointer cast (c6aa9e38) · Commits · Wenxi XU / zephyr

The 11v_btm_query shell command was calling parse_number() using a pointer to uint8_t. This will cause memory overwrite and possible crash. Convert to use long temporary value to avoid this. Fix also the output prints in case of an error. Signed-off-by:

Jukka Rissanen <jukka.rissanen@nordicsemi.no>

subsys/net/l2/wifi/wifi_shell.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -1671,16 +1671,19 @@ static int cmd_wifi_btm_query(const struct shell sh, size_t argc, char argv[])
		{
		struct net_if *iface = net_if_get_first_wifi();
		uint8_t query_reason = 0;
		long tmp = 0;

		context.sh = sh;

		if (!parse_number(sh, (long *)&query_reason, argv[1], NULL,
		if (!parse_number(sh, &tmp, argv[1], NULL,
		WIFI_BTM_QUERY_REASON_UNSPECIFIED, WIFI_BTM_QUERY_REASON_LEAVING_ESS)) {
		return -EINVAL;
		}

		query_reason = tmp;

		if (net_mgmt(NET_REQUEST_WIFI_BTM_QUERY, iface, &query_reason, sizeof(query_reason))) {
		PR_WARNING("Setting BTM query Reason failed..Reason :%d\n", query_reason);
		PR_WARNING("Setting BTM query Reason failed. Reason : %d\n", query_reason);
		return -ENOEXEC;
		}

Admin message