Fixes unchecked results from parsecmd Before accessing the strings of a parsecmd, we must check the nf (num fields). Many devices were not checking, so something like echo "" > /net/ether0/stats Would trigger a PF. Using lookupcmd() is safe, since it check the nf internally. But any naked access to the fields (like with strcmp) requires a check.

diff --git a/kern/drivers/dev/alarm.c b/kern/drivers/dev/alarm.c
index d131d8f..096d086 100644
--- a/kern/drivers/dev/alarm.c
+++ b/kern/drivers/dev/alarm.c

@@ -363,6 +363,8 @@
 				kfree(cb);
 				nexterror();
 			}
+			if (cb->nf < 1)
+				error("short control request");
 			if (!strcmp(cb->f[0], "evq")) {
 				if (cb->nf < 2)
 					error("evq needs a pointer");

diff --git a/kern/drivers/dev/ether.c b/kern/drivers/dev/ether.c
index b774889..99921bb 100644
--- a/kern/drivers/dev/ether.c
+++ b/kern/drivers/dev/ether.c

@@ -429,6 +429,10 @@
 		if (l >= 0)
 			goto out;
 		cb = parsecmd(buf, n);
+		if (cb->nf < 1) {
+			kfree(cb);
+			error("short control request");
+		}
 		if (strcmp(cb->f[0], "nonblocking") == 0) {
 			if (cb->nf <= 1)
 				onoff = 1;

diff --git a/kern/drivers/dev/nix.c b/kern/drivers/dev/nix.c
index 7ed4386..a50bcef 100644
--- a/kern/drivers/dev/nix.c
+++ b/kern/drivers/dev/nix.c

@@ -430,6 +430,8 @@
 			kfree(cb);
 			nexterror();
 		}
+		if (cb->nf < 1)
+			error("short control request");
 		if (!strcmp(cb->f[0], "run")) {
 			int core;
 			uintptr_t ip;

diff --git a/kern/drivers/dev/vm.c b/kern/drivers/dev/vm.c
index 9c7abb7..67b3924 100644
--- a/kern/drivers/dev/vm.c
+++ b/kern/drivers/dev/vm.c

@@ -446,6 +446,8 @@
 				kfree(cb);
 				nexterror();
 			}
+			if (cb->nf < 1)
+				error("short control request");
 			if (!strcmp(cb->f[0], "run")) {
 				int ret;
 				if (cb->nf != 4)

diff --git a/kern/drivers/net/bnx2x/bnx2x_dev.c b/kern/drivers/net/bnx2x/bnx2x_dev.c
index 60e276b..a989290 100644
--- a/kern/drivers/net/bnx2x/bnx2x_dev.c
+++ b/kern/drivers/net/bnx2x/bnx2x_dev.c

@@ -107,6 +107,8 @@
 		kfree(cb);
 		nexterror();
 	}
+	if (cb->nf < 1)
+		error("short control request");
 
 	/* TODO: handle ctl command somehow.  igbe did the following: */
 	//ct = lookupcmd(cb, igbectlmsg, ARRAY_SIZE(igbectlmsg));

diff --git a/kern/src/net/iproute.c b/kern/src/net/iproute.c
index 3f0693d..27db012 100644
--- a/kern/src/net/iproute.c
+++ b/kern/src/net/iproute.c

@@ -793,6 +793,8 @@
 		kfree(cb);
 		nexterror();
 	}
+	if (cb->nf < 1)
+		error("short control request");
 
 	if (strcmp(cb->f[0], "flush") == 0) {
 		tag = cb->f[1];