Fix memory bounds error

[proxmark3-svn] / client / cmdhflegic.c

diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c
index bf874b624c40aad34a255834176233c4d1a65dbf..c9f3485e10c16aa192218518b5618c680689f758 100644 (file)
--- a/client/cmdhflegic.c
+++ b/client/cmdhflegic.c
@@ -10,13 +10,14 @@
 
 #include <stdio.h>
 #include <string.h>
+#include <inttypes.h>
 #include "proxmark3.h"
 #include "data.h"
 #include "ui.h"
 #include "cmdparser.h"
 #include "cmdhflegic.h"
 #include "cmdmain.h"
-
+#include "util.h"
 static int CmdHelp(const char *Cmd);
 
 static command_t CommandTable[] = 
@@ -58,7 +59,7 @@ int CmdLegicDecode(const char *Cmd)
   int crc = 0;
   int wrp = 0;
   int wrc = 0;
-  uint8_t data_buf[1024]; // receiver buffer
+  uint8_t data_buf[1053]; // receiver buffer
   char out_string[3076]; // just use big buffer - bad practice
   char token_type[4];
   
@@ -218,7 +219,24 @@ int CmdLegicRFRead(const char *Cmd)
 
 int CmdLegicLoad(const char *Cmd)
 {
-    FILE *f = fopen(Cmd, "r");
+       char filename[FILE_PATH_SIZE] = {0x00};
+       int len = 0;
+       
+       if (param_getchar(Cmd, 0) == 'h' || param_getchar(Cmd, 0)== 0x00) {
+               PrintAndLog("It loads datasamples from the file `filename`");
+               PrintAndLog("Usage:  hf legic load <file name>");
+               PrintAndLog(" sample: hf legic load filename");
+               return 0;
+       }
+
+       len = strlen(Cmd);      
+       if (len > FILE_PATH_SIZE) {
+               PrintAndLog("Filepath too long (was %s bytes), max allowed is %s ", len, FILE_PATH_SIZE);
+               return 0;
+       }
+       memcpy(filename, Cmd, len);
+
+    FILE *f = fopen(filename, "r");
     if(!f) {
         PrintAndLog("couldn't open '%s'", Cmd);
         return -1;
@@ -233,7 +251,7 @@ int CmdLegicLoad(const char *Cmd)
           fclose(f);
           return -1;
         }
-        UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {offset, 0, 0}};
+        UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {offset, 1, 0}};
         int j; for(j = 0; j < 8; j++) {
             c.d.asBytes[j] = data[j];
         }
@@ -251,7 +269,7 @@ int CmdLegicSave(const char *Cmd)
   int requested = 1024;
   int offset = 0;
   int delivered = 0;
-  char filename[1024];
+  char filename[FILE_PATH_SIZE];
   uint8_t got[1024];
   
   sscanf(Cmd, " %s %i %i", filename, &requested, &offset);
@@ -306,7 +324,7 @@ int CmdLegicRfSim(const char *Cmd)
    c.arg[0] = 6;
    c.arg[1] = 3;
    c.arg[2] = 0;
-   sscanf(Cmd, " %"lli" %"lli" %"lli, &c.arg[0], &c.arg[1], &c.arg[2]);
+   sscanf(Cmd, " %" SCNi64 " %" SCNi64 " %" SCNi64, &c.arg[0], &c.arg[1], &c.arg[2]);
    SendCommand(&c);
    return 0;
 }
@@ -314,7 +332,7 @@ int CmdLegicRfSim(const char *Cmd)
 int CmdLegicRfWrite(const char *Cmd)
 {
     UsbCommand c={CMD_WRITER_LEGIC_RF};
-    int res = sscanf(Cmd, " 0x%"llx" 0x%"llx, &c.arg[0], &c.arg[1]);
+    int res = sscanf(Cmd, " 0x%" SCNx64 " 0x%" SCNx64, &c.arg[0], &c.arg[1]);
        if(res != 2) {
                PrintAndLog("Please specify the offset and length as two hex strings");
         return -1;
@@ -326,14 +344,14 @@ int CmdLegicRfWrite(const char *Cmd)
 int CmdLegicRfFill(const char *Cmd)
 {
     UsbCommand cmd ={CMD_WRITER_LEGIC_RF};
-    int res = sscanf(Cmd, " 0x%"llx" 0x%"llx" 0x%"llx, &cmd.arg[0], &cmd.arg[1], &cmd.arg[2]);
+    int res = sscanf(Cmd, " 0x%" SCNx64 " 0x%" SCNx64 " 0x%" SCNx64, &cmd.arg[0], &cmd.arg[1], &cmd.arg[2]);
     if(res != 3) {
         PrintAndLog("Please specify the offset, length and value as two hex strings");
         return -1;
     }
 
     int i;
-    UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {0, 0, 0}};
+    UsbCommand c={CMD_DOWNLOADED_SIM_SAMPLES_125K, {0, 1, 0}};
     for(i = 0; i < 48; i++) {
       c.d.asBytes[i] = cmd.arg[2];
     }