drivers: mdio: shell: Fix various buffer overflows

Need to check argument count to avoid buffer overflows and crashes.

Signed-off-by: Cla Mattia Galliard <[email protected]>

Author: clamattia

drivers/mdio/mdio_shell.c

@@ -32,8 +32,12 @@ static void device_name_get(size_t idx, struct shell_static_entry *entry)
 
 SHELL_DYNAMIC_CMD_CREATE(dsub_device_name, device_name_get);
 
-static int parse_device_arg(const struct shell *sh, char **argv, const struct device **dev)
+static int parse_device_arg(const struct shell *sh, size_t argc, char **argv, const struct device **dev)
 {
+	if (argc < 2) {
+		shell_error(sh, "not enough arguments");
+		return -EINVAL;
+	}
 	*dev = shell_device_get_binding(argv[1]);
 	if (!*dev) {
 		shell_error(sh, "device %s not found", argv[1]);
@@ -55,12 +59,12 @@ static int cmd_mdio_scan(const struct shell *sh, size_t argc, char **argv)
 	uint16_t reg_addr;
 	int ret;
 
-	ret = parse_device_arg(sh, argv, &dev);
+	ret = parse_device_arg(sh, argc, argv, &dev);
 	if (ret < 0) {
 		return ret;
 	}
 
-	if (argc >= 2) {
+	if (argc >= 3) {
 		reg_addr = strtol(argv[2], NULL, 16);
 	} else {
 		reg_addr = 0;
@@ -98,11 +102,16 @@ static int cmd_mdio_write(const struct shell *sh, size_t argc, char **argv)
 	uint16_t port_addr;
 	int ret;
 
-	ret = parse_device_arg(sh, argv, &dev);
+	ret = parse_device_arg(sh, argc, argv, &dev);
 	if (ret < 0) {
 		return ret;
 	}
 
+	if (argc < 5) {
+		shell_error(sh, "not enough arguments");
+		return -EINVAL;
+	}
+
 	port_addr = strtol(argv[2], NULL, 16);
 	reg_addr = strtol(argv[3], NULL, 16);
 	data = strtol(argv[4], NULL, 16);
@@ -130,11 +139,16 @@ static int cmd_mdio_read(const struct shell *sh, size_t argc, char **argv)
 	uint16_t port_addr;
 	int ret;
 
-	ret = parse_device_arg(sh, argv, &dev);
+	ret = parse_device_arg(sh, argc, argv, &dev);
 	if (ret < 0) {
 		return ret;
 	}
 
+	if (argc < 4) {
+		shell_error(sh, "not enough arguments");
+		return -EINVAL;
+	}
+
 	port_addr = strtol(argv[2], NULL, 16);
 	reg_addr = strtol(argv[3], NULL, 16);
 
@@ -164,11 +178,16 @@ static int cmd_mdio_write_45(const struct shell *sh, size_t argc, char **argv)
 	uint8_t port_addr;
 	int ret;
 
-	ret = parse_device_arg(sh, argv, &dev);
+	ret = parse_device_arg(sh, argc, argv, &dev);
 	if (ret < 0) {
 		return ret;
 	}
 
+	if (argc < 6) {
+		shell_error(sh, "not enough arguments");
+		return -EINVAL;
+	}
+
 	port_addr = strtol(argv[2], NULL, 16);
 	dev_addr = strtol(argv[3], NULL, 16);
 	reg_addr = strtol(argv[4], NULL, 16);
@@ -198,11 +217,16 @@ static int cmd_mdio_read_c45(const struct shell *sh, size_t argc, char **argv)
 	uint8_t port_addr;
 	int ret;
 
-	ret = parse_device_arg(sh, argv, &dev);
+	ret = parse_device_arg(sh, argc, argv, &dev);
 	if (ret < 0) {
 		return ret;
 	}
 
+	if (argc < 5) {
+		shell_error(sh, "not enough arguments");
+		return -EINVAL;
+	}
+
 	port_addr = strtol(argv[2], NULL, 16);
 	dev_addr = strtol(argv[3], NULL, 16);
 	reg_addr = strtol(argv[4], NULL, 16);