static int cmd_write(const struct shell *shell_ptr, size_t argc, char *argv[])
{
    int err;
    uint8_t buffer[CONFIG_SHELL_CMD_BUFF_SIZE / 2];
    size_t buffer_len = 0;
    enum settings_value_types value_type = SETTINGS_VALUE_HEX;
    if (argc > 3) {
        err = settings_parse_type(argv[1], &value_type);
        if (err) {
            shell_error(shell_ptr, "Invalid type: %s", argv[1]);
            return err;
        }
    }
    switch (value_type) {
    case SETTINGS_VALUE_HEX:
        buffer_len = hex2bin(argv[argc - 1], strlen(argv[argc - 1]),
            buffer, sizeof(buffer));
        break;
    case SETTINGS_VALUE_STRING:
        buffer_len = strlen(argv[argc - 1]) + 1; // CAN BE GREATER THAN CONFIG_SHELL_CMD_BUFF_SIZE / 2
        memcpy(buffer, argv[argc - 1], buffer_len); // VULN
        break;
    }
 
Summary
Unchecked length coming from user input in settings shell:
https://github.com/zephyrproject-rtos/zephyr/blob/main/subsys/settings/src/settings_shell.c#L184C9-L184C9
Details
Patches
main: #66451
v3.5: #66584
embargo: 2024-02-18
For more information
If you have any questions or comments about this advisory: