From 9d15dfe6ac334a2fee251e4f09378f16d018c139 Mon Sep 17 00:00:00 2001
From: kudasai <47227786+kudasaixc@users.noreply.github.com>
Date: Sat, 4 Jul 2026 17:29:01 +0200
Subject: [PATCH] fix(shell): stack overflow when a command has MAX_CMD_ARGS
 tokens

shell_execute declares `char *args[MAX_CMD_ARGS]` (16 slots) but
shell_parse fills args[0..15] and then writes args[argc] = NULL. With
16+ whitespace-separated tokens argc reaches 16, so the NULL is written
to args[16] -- one pointer past the end of the on-stack array,
corrupting the adjacent stack slot. This is reachable from any keyboard
input, e.g. a line of 16 words. Size the array MAX_CMD_ARGS + 1 to hold
the argv-style NULL sentinel.
---
 src/kernel/shell.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/kernel/shell.c b/src/kernel/shell.c
index 575ab67..5202e5b 100644
--- a/src/kernel/shell.c
+++ b/src/kernel/shell.c
@@ -75,7 +75,7 @@ void debug_trigger_page_fault(void) {
 }
 
 static void shell_execute(char *cmd) {
-  char *args[MAX_CMD_ARGS];
+  char *args[MAX_CMD_ARGS + 1]; // +1 for the NULL terminator written by shell_parse
   int argc = shell_parse(cmd, args);
   if (argc == 0)
     return;