view rvinterf/asyncshell/sendsp.c @ 1011:6d9b10633f10

etmsync Pirelli IMEI retrieval: fix poor use of printf() Bug reported by Vadim Yanitskiy <fixeria@osmocom.org>: the construct where a static-allocated string was passed to printf() without any format arguments causes newer compilers to report a security problem. Given that formatted output is not needed here, just fixed string output, change printf() to fputs(), and direct the error message to stderr while at it.
author Mychaela Falconia <falcon@freecalypso.org>
date Thu, 23 May 2024 17:29:57 +0000
parents d43d82cbfb85
children
line wrap: on
line source

/*
 * Functions for sending GPF system primitives to the target
 */

#include <sys/types.h>
#include <stdio.h>
#include <ctype.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
#include "pktmux.h"
#include "limits.h"
#include "exitcodes.h"

send_gpf_sysprim(stackdest, primstr)
	char *stackdest, *primstr;
{
	unsigned intlen;
	u_char sendpkt[MAX_PKT_TO_TARGET+1];
	unsigned pktlen;

	if (strlen(stackdest) > 4) {
		printf(
		  "error: stack destination arg may not exceed 4 characters\n");
		return(ERROR_USAGE);
	}
	intlen = 12 + strlen(primstr);
	pktlen = intlen + 4;
	if (pktlen > MAX_PKT_TO_TARGET) {
		printf("error: max pkt to target limit exceeded\n");
		return(ERROR_USAGE);
	}
	/* fill out the packet */
	sendpkt[0] = RVT_L23_HEADER;
	sendpkt[1] = 0xB7;	/* system prim */
	sendpkt[2] = intlen;
	sendpkt[3] = intlen >> 8;
	/* send zeros for the timestamp */
	sendpkt[4] = 0;
	sendpkt[5] = 0;
	sendpkt[6] = 0;
	sendpkt[7] = 0;
	/* as far as TI's sw is concerned, we are PCO */
	sendpkt[8] = 'P';
	sendpkt[9] = 'C';
	sendpkt[10] = 'O';
	sendpkt[11] = ' ';
	sprintf(sendpkt + 12, "%-4s%s", stackdest, primstr);
	/* send it! */
	send_pkt_to_target(sendpkt, pktlen);
	return(0);
}

void
cmd_sp_interactive(args)
	char *args;
{
	char *cp, *np;

	for (cp = args; isspace(*cp); cp++)
		;
	if (!*cp) {
err:		printf("error: two arguments required\n");
		return;
	}
	for (np = cp; *cp && !isspace(*cp); cp++)
		;
	if (!*cp)
		goto err;
	*cp++ = '\0';
	while (isspace(*cp))
		cp++;
	if (!*cp)
		goto err;
	gpf_rx_control(1);
	send_gpf_sysprim(np, cp);
}

cmd_sp_oneshot(argc, argv)
	char **argv;
{
	return send_gpf_sysprim(argv[1], argv[2]);
}