[posix] avoid CLI buffer overflow (#6578)

script/check-posix-pty

@@ -134,6 +134,20 @@ do_check()
         sudo "${OT_CTL}" -I "${NETIF_NAME}" factoryreset
         # sleep a while for daemon ready
         sleep 2
+
+        readonly OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH=640
+        local -r kMaxStringLength="$((OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH - 1))"
+
+        # verify success if command length doesn't exceed the limit
+        for len in $(seq 1 ${kMaxStringLength}); do
+            sudo "${OT_CTL}" -I "${NETIF_NAME}" "$(printf '1%.0s' $(seq 1 "${len}"))"
+        done
+
+        # verify failure if command length exceeds the limit
+        len=${OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH}
+        if sudo "${OT_CTL}" -I "${NETIF_NAME}" "$(printf '1%.0s' $(seq 1 "${len}"))"; then
+            die
+        fi
         OT_CLI_CMD="${OT_CTL} -I ${NETIF_NAME}"
     else
         OT_CLI="$PWD/build/posix/src/posix/ot-cli"

src/cli/cli_config.h

@@ -49,7 +49,7 @@
 /**
  * @def OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH
  *
- * The maximum size of the CLI line in bytes.
+ * The maximum size of the CLI line in bytes including the null terminator.
  *
  */
 #ifndef OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH

src/posix/client.cpp

@@ -197,9 +197,9 @@ void PrintUsage(const char *aProgramName, FILE *aStream, int aExitCode)
     exit(aExitCode);
 }
 
-bool IsSeparator(char aChar)
+static bool ShouldEscape(char aChar)
 {
-    return (aChar == ' ') || (aChar == '\t') || (aChar == '\r') || (aChar == '\n');
+    return (aChar == ' ') || (aChar == '\t') || (aChar == '\r') || (aChar == '\n') || (aChar == '\\');
 }
 
 Config ParseArg(int &aArgCount, char **&aArgVector)
@@ -253,20 +253,27 @@ int main(int argc, char *argv[])
 
         for (int i = 0; i < argc; i++)
         {
-            for (const char *c = argv[i]; *c; ++c)
+            for (const char *c = argv[i]; *c && count < sizeof(buffer);)
             {
-                if (IsSeparator(*c))
+                if (ShouldEscape(*c))
                 {
                     buffer[count++] = '\\';
+
+                    VerifyOrExit(count < sizeof(buffer), ret = OT_EXIT_INVALID_ARGUMENTS);
                 }
-                buffer[count++] = *c;
+
+                buffer[count++] = *c++;
             }
+
+            VerifyOrExit(count < sizeof(buffer), ret = OT_EXIT_INVALID_ARGUMENTS);
             buffer[count++] = ' ';
         }
 
-        // replace the trailing space with newline
-        buffer[count - 1] = '\n';
-        VerifyOrExit(DoWrite(sSessionFd, buffer, count), ret = OT_EXIT_FAILURE);
+        // ignore the trailing space
+        if (--count)
+        {
+            VerifyOrExit(DoWrite(sSessionFd, buffer, count), ret = OT_EXIT_FAILURE);
+        }
 
         isInteractive = false;
     }

src/posix/platform/daemon.cpp

@@ -284,7 +284,8 @@ void platformDaemonProcess(const otSysMainloopContext *aContext)
     {
         uint8_t buffer[OPENTHREAD_CONFIG_CLI_MAX_LINE_LENGTH];
 
-        rval = read(sSessionSocket, buffer, sizeof(buffer));
+        // leave 1 byte for the null terminator
+        rval = read(sSessionSocket, buffer, sizeof(buffer) - 1);
 
         if (rval > 0)
         {