The variable base is unsigned so >= 0 is always true. Fix this test
so that it is actually useful. The fix prevents the code from causing
a segfault in the case where Ctrl-w is pressed on a line consisting
only of spaces.

Fixes: dcc18ce0dbaf ("cli: Implement delete-word in cread_line()")
Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org>
---
This bug was found using Smatch
---
 common/cli_readline.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/common/cli_readline.c b/common/cli_readline.c
index 4e6797a1944..0cb43e62000 100644
--- a/common/cli_readline.c
+++ b/common/cli_readline.c
@@ -332,8 +332,8 @@ int cread_line_process_ch(struct cli_line_state *cls, char 
ichar)
                if (cls->num) {
                        uint base, wlen;
 
-                       for (base = cls->num - 1;
-                            base >= 0 && buf[base] == ' ';)
+                       for (base = cls->num;
+                            base > 0 && buf[base - 1] == ' ';)
                                base--;
                        for (; base > 0 && buf[base - 1] != ' ';)
                                base--;

---
base-commit: 903eb123236ccbd8ef05d43507a2a910b785bd56
change-id: 20250624-readline_fix-4ea90584023d

Best regards,
-- 
Andrew Goodbody <andrew.goodb...@linaro.org>

Reply via email to