From b487920cf409fa6eb675c220dc618b25441c6204 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Beat=20K=C3=BCng?= <beat-kueng@gmx.net>
Date: Mon, 4 Nov 2019 11:55:13 +0100
Subject: [PATCH] fix batt_smbus: add bound checks when accessing argv

---
 src/drivers/batt_smbus/batt_smbus.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/drivers/batt_smbus/batt_smbus.cpp b/src/drivers/batt_smbus/batt_smbus.cpp
index 9a1a49e0eb..fa200f220b 100644
--- a/src/drivers/batt_smbus/batt_smbus.cpp
+++ b/src/drivers/batt_smbus/batt_smbus.cpp
@@ -620,7 +620,7 @@ int BATT_SMBUS::custom_command(int argc, char *argv[])
 	}
 
 	if (!strcmp(input, "write_flash")) {
-		if (argv[1] && argv[2]) {
+		if (argc >= 3) {
 			uint16_t address = atoi(argv[1]);
 			unsigned length = atoi(argv[2]);
 			uint8_t tx_buf[32] = {};
@@ -632,7 +632,9 @@ int BATT_SMBUS::custom_command(int argc, char *argv[])
 
 			// Data needs to be fed in 1 byte (0x01) at a time.
 			for (unsigned i = 0; i < length; i++) {
-				tx_buf[i] = atoi(argv[3 + i]);
+				if ((unsigned)argc <= 3 + i) {
+					tx_buf[i] = atoi(argv[3 + i]);
+				}
 			}
 
 			if (PX4_OK != obj->dataflash_write(address, tx_buf, length)) {