From 5a029f907a12e5e8f85e7dc57d311912b9efd36a Mon Sep 17 00:00:00 2001
From: PhysicistJohn <54456354+PhysicistJohn@users.noreply.github.com>
Date: Sat, 11 Jul 2026 14:03:52 -0700
Subject: [PATCH] fix: validate shell-controlled array indices

---
 main.c | 37 ++++++++++++++++++++++++++-----------
 ui.c   |  4 +++-
 2 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/main.c b/main.c
index 03ee392..b7b9bd8 100644
--- a/main.c
+++ b/main.c
@@ -2041,15 +2041,23 @@ show_one:
   static const char cmd_load_list[] = "copy|freeze|subtract|view|value";
   if (argc >= 2) {
     switch (get_str_index(argv[next_arg++], cmd_load_list)) {
-    case 0:
-      store_trace(t, my_atoi(argv[next_arg++])-1); // copy {trace}
+    case 0: {
+      int destination = my_atoi(argv[next_arg++])-1; // copy {trace}
+      if ((uint32_t)destination >= TRACES_MAX)
+        goto usage;
+      store_trace(t, destination);
       goto update;
+      }
     case 1:
       setting.stored[t]= (get_str_index(argv[next_arg++], "off|on") == 1); // freeze {off|on}
       goto update;
-    case 2:
-      subtract_trace(t,my_atoi(argv[next_arg++])-1);
+    case 2: {
+      int source = my_atoi(argv[next_arg++])-1;
+      if ((uint32_t)source >= TRACES_MAX)
+        goto usage;
+      subtract_trace(t, source);
       goto update;
+      }
     case 3:
       if (get_str_index(argv[next_arg++], "off|on") == 1)
         { TRACE_ENABLE(1<<t); }
@@ -2058,8 +2066,10 @@ show_one:
       goto update;
     case 4:
       {
+      if (argc != 3)
+        goto usage;
       int i = my_atoi(argv[next_arg++]);
-      if (i>= sweep_points)
+      if ((uint32_t)i >= sweep_points)
         goto usage;
       float v = my_atof(argv[next_arg]);
       measured[t][i] = v;
@@ -2138,8 +2148,12 @@ VNA_SHELL_FUNCTION(cmd_marker)
       //      M_NORMAL=0,M_REFERENCE=1, M_DELTA=2, M_NOISE=4, M_STORED=8, M_AVER=16, M_TRACKING=32, M_DELETE=64  // Tracking must be last.
     case 3:
       tr=0;
-      if (argc == 3 && argv[2][0] >= '1' && argv[2][0] <= '9') {
+      if (argc != 3)
+        goto usage;
+      if (argv[2][0] >= '1' && argv[2][0] <= '9') {
         tr = my_atoui(argv[2])-1;
+        if ((uint32_t)tr >= MARKERS_MAX)
+          goto usage;
         markers[t].mtype |= M_DELTA;
         markers[t].ref= tr;
       } else if (get_str_index(argv[2],cmd_marker_on_off) == 0) {
@@ -2153,10 +2167,11 @@ VNA_SHELL_FUNCTION(cmd_marker)
       marker_mask = M_TRACKING;
       goto set_mask;
     case 6:
-      tr=0;
-      if (argc == 3 && argv[2][0] >= '1' && argv[2][0] <= '9') {
-        tr = my_atoui(argv[2])-1;
-      }
+      if (argc != 3 || argv[2][0] < '1' || argv[2][0] > '9')
+        goto usage;
+      tr = my_atoui(argv[2])-1;
+      if ((uint32_t)tr >= TRACES_MAX)
+        goto usage;
       markers[t].trace= tr;
       return;
     case 7:
@@ -2384,7 +2399,7 @@ VNA_SHELL_FUNCTION(cmd_color)
     return;
   }
   i = my_atoi(argv[0]);
-  if (i >= MAX_PALETTE)
+  if (i < 0 || i >= MAX_PALETTE)
     return;
   color = RGBHEX(my_atoui(argv[1]));
   config.lcd_palette[i] = color;
diff --git a/ui.c b/ui.c
index b2847fd..6190e68 100644
--- a/ui.c
+++ b/ui.c
@@ -6638,9 +6638,11 @@ static const menuitem_t *menu_next_item(const menuitem_t *m, int *sub_item){
 }
 
 static const menuitem_t *current_menu_item(int i, int *sub_item){
+  if (i < 0)
+    return NULL;
   *sub_item = 0;
   const menuitem_t * m = menu_stack[menu_current_level];
-  while (i--) m = menu_next_item(m,sub_item);
+  while (i-- && m != NULL) m = menu_next_item(m,sub_item);
   return m;
 }