fix(shell): one-past-the-end write in argv array when a command has MAX_CMD_ARGS tokens

[kudasaixc]

When a command line has 16 or more space-separated tokens, shell_parse writes one pointer past the end of the args array on the stack.

shell_execute declares the array with exactly MAX_CMD_ARGS slots:

char *args[MAX_CMD_ARGS];   // 16 slots, indices 0..15
int argc = shell_parse(cmd, args);

shell_parse fills args[0..15] and then always writes the NULL sentinel at args[argc]:

while (cmd[i] != '\0' && argc < MAX_CMD_ARGS) {  // argc can reach 16
    args[argc++] = &cmd[i];
    ...
}
args[argc] = NULL;   // argc == 16 -> writes args[16], past the array

So a line of 16 words makes argc reach 16 and args[16] = NULL writes 4 bytes past the array. It's reachable from normal keyboard input, and the tree builds with -fno-stack-protector. It's undefined behaviour; whether it does anything visible depends on the stack layout (see the note below, I could not get it to actually crash on the current toolchain).

Fix is to size the array for the NULL terminator, like a normal argv:

char *args[MAX_CMD_ARGS + 1];

No behaviour change for valid input.

[kudasaixc]

Small runtime note, I built this locally with the same setup as CI (Zig 0.16.0 + NASM, the USE_ZIG=1 path) and ran it in QEMU with AURI_TEST_MODE.

With the fix, a 16-token command (echo + 15 args, so argc == 16) is handled cleanly and the shell keeps working:

root@auri-os~$ echo a a a a a a a a a a a a a a a
a a a a a a a a a a a a a a a
root@auri-os~$ uptime -s
7s

On the unfixed build the same command did not crash either. The write is always exactly one slot (argc is capped at MAX_CMD_ARGS, so it's always args[16] = NULL), and with the current GCC/Zig stack layout that slot happens to land on harmless padding.

So to be straight about it: it's a real one-past-the-end write (undefined behaviour, and the tree builds with -fno-stack-protector), worth fixing as hardening, but I couldn't get it to actually crash on the current toolchain. So it's a latent defect, not a live crash. The fix stays a safe one-liner (args[MAX_CMD_ARGS + 1]).

[im-nymii]

LGTM