view rvinterf/tmsh/etmbasic.c @ 1011:6d9b10633f10 default tip

etmsync Pirelli IMEI retrieval: fix poor use of printf() Bug reported by Vadim Yanitskiy <fixeria@osmocom.org>: the construct where a static-allocated string was passed to printf() without any format arguments causes newer compilers to report a security problem. Given that formatted output is not needed here, just fixed string output, change printf() to fputs(), and direct the error message to stderr while at it.
author Mychaela Falconia <falcon@freecalypso.org>
date Thu, 23 May 2024 17:29:57 +0000
parents 9706832b740b
children
line wrap: on
line source

/*
 * Basic ETM interaction
 */

#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
#include "pktmux.h"
#include "limits.h"
#include "etm.h"
#include "tm3.h"
#include "exitcodes.h"

extern u_char rvi_msg[];
extern int rvi_msg_len;

void
print_etm_pkt_raw(err)
	char *err;
{
	char buf[MAX_PKT_FROM_TARGET*3+80], *dp;
	int i;

	sprintf(buf, "%s:", err);
	dp = index(buf, '\0');
	for (i = 2; i < rvi_msg_len; i++) {
		sprintf(dp, " %02X", rvi_msg[i]);
		dp += 3;
	}
	async_msg_output(buf);
}

void
etm_packet_rx()
{
	int i, c;

	if (rvi_msg_len < 4) {
runt:		print_etm_pkt_raw("TM runt");
		return;
	}
	c = 0;
	for (i = 2; i < rvi_msg_len; i++)
		c ^= rvi_msg[i];
	if (c) {
		print_etm_pkt_raw("BAD CKSUM");
		return;
	}
	switch (rvi_msg[2]) {
	case ETM_CORE:
		if (rvi_msg_len < 6)
			goto runt;
		tmcore_msg_rx();
		return;
	case ETM_FFS1:
		print_etm_pkt_raw("FFS1");
		return;
	case ETM_FFS2:
		if (rvi_msg_len < 5)
			goto runt;
		handle_ffs2_response();
		return;
	case ETM_AUDIO:
		if (rvi_msg_len < 6)
			goto runt;
		etm_audio_msg_rx();
		return;
	case ETM_BSIM:
		if (rvi_msg_len < 5)
			goto runt;
		handle_bsim_response();
		return;
	/* TM3 */
	case MEM_READ:
		if (rvi_msg_len < 5)
			goto runt;
		handle_omr_response();
		return;
	case MEM_WRITE:
		l1tm_response_nodata("omw");
		return;
	case CODEC_READ:
		if (rvi_msg_len < 5)
			goto runt;
		handle_oabbr_response();
		return;
	case CODEC_WRITE:
		l1tm_response_nodata("oabbw");
		return;
	/* L1TM */
	case TM_INIT:
		l1tm_response_nodata("tminit");
		return;
	case TM_MODE_SET:
		l1tm_response_nodata("tms");
		return;
	case VERSION_GET:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("tm3ver");
		return;
	case RF_ENABLE:
		l1tm_rfe_response();
		return;
	case STATS_READ:
		l1tm_stats_response();
		return;
	case STATS_CONFIG_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("scw");
		return;
	case STATS_CONFIG_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("scr");
		return;
	case RF_PARAM_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("rfpw");
		return;
	case RF_PARAM_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("rfpr");
		return;
	case RF_TABLE_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("rftw");
		return;
	case RF_TABLE_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_rftr_response();
		return;
	case RX_PARAM_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("rxpw");
		return;
	case RX_PARAM_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("rxpr");
		return;
	case TX_PARAM_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("txpw");
		return;
	case TX_PARAM_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("txpr");
		return;
	case TX_TEMPLATE_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_ttw_response();
		return;
	case TX_TEMPLATE_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_ttr_response();
		return;
	case MISC_PARAM_WRITE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("mpw");
		return;
	case MISC_PARAM_READ:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index_val("mpr");
		return;
	case MISC_ENABLE:
		if (rvi_msg_len < 5)
			goto runt;
		l1tm_response_index("me");
		return;
	default:
		print_etm_pkt_raw("TM unknown");
	}
}

cmd_tmpkt(argc, argv)
	char **argv;
{
	u_char pkt[MAX_PKT_TO_TARGET];
	int di, c, b;
	char **ap;

	pkt[0] = RVT_TM_HEADER;
	di = 1;
	c = 0;
	for (ap = argv + 1; *ap; ap++) {
		b = strtoul(*ap, 0, 16);
		pkt[di++] = b;
		c ^= b;
	}
	pkt[di++] = c;
	send_pkt_to_target(pkt, di);
	return(0);
}

void
send_etm_cmd(buf, len)
	u_char *buf;
{
	int i, c;

	buf[0] = RVT_TM_HEADER;
	c = 0;
	for (i = 1; i <= len; i++)
		c ^= buf[i];
	buf[i] = c;
	send_pkt_to_target(buf, len + 2);
}