From 8190b4018ed2488279631fd6dab79404d0127331 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Mon, 5 Oct 2026 12:14:47 -0700 Subject: [PATCH] cli: reject a negative `sensor list` start index `sensor list ` parsed start with _atoi(), whose uint32_t goes negative as an int: a start of 4294967295 is -1 and 2147483648 is INT_MIN. Both passed the `start >= end` guard, so the loop asked the sensor manager for a negative index and passed the NULL it returned to "%s=%s", undefined behaviour that picolibc happens to print as "(null)". Rejecting a negative start closes it: ZephyrSensorManager has one setting, so only index 0 is ever requested. The same defect as meshcore-dev/MeshCore#3433. Co-Authored-By: Claude Opus 5.5 --- zephcore/helpers/CommonCLI.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zephcore/helpers/CommonCLI.cpp b/zephcore/helpers/CommonCLI.cpp index 1a64fd0..9ea10d6 100644 --- a/zephcore/helpers/CommonCLI.cpp +++ b/zephcore/helpers/CommonCLI.cpp @@ -589,7 +589,7 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch if (strlen(command) > 11) { start = _atoi(command + 12); } - if (start >= end) { + if (start < 0 || start >= end) { strcpy(reply, "no custom var"); } else { snprintf(dp, CLI_REPLY_SIZE - (dp - reply), "%d vars\n", end);