From 0b8ebc540dd67e5e940cb3e06de87e99000bc29c Mon Sep 17 00:00:00 2001 From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com> Date: Fri, 31 Jul 2026 12:51:41 +0300 Subject: [PATCH] backup: read board vendor/model from the right cJSON nodes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit do_upgrade() looked up the "vendor" and "model" items of the board info object, then called cJSON_GetStringValue(binfo) on the *object* instead of on the item it had just found. cJSON_GetStringValue() returns NULL for a non-string, so: - the vendor branch was NULL-guarded and silently did nothing; - the model branch was not, and ran strcpy(board_id, NULL). So `ipctool upgrade` segfaults on any board whose detector supplies a "model" key — currently Ruision, Anjoy and Hankvision (src/boards/*.c) — and on every other board it leaves board_id empty, so the "hardware" U-Boot variable set from it further down never gets written. Read the values from c_vendor/c_model, guard both against NULL, and bound the copies with snprintf: the strings come from board detection (sysinfo files, directory names) and were being strcpy/strcat'ed into fixed 1024-byte buffers unchecked. Behaviour is otherwise preserved, including board_id carrying the model alone. Note: `board` is assembled here but never read afterwards. That is pre-existing, so left alone rather than silently changing what the composed string is meant to be. Co-Authored-By: Claude Opus 4.8 --- src/backup.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/src/backup.c b/src/backup.c index 46a845d..fc0be54 100644 --- a/src/backup.c +++ b/src/backup.c @@ -880,18 +880,16 @@ static int do_upgrade(const char *filename, bool force) { cJSON *binfo = detect_board(); char board[1024] = {0}, board_id[1024] = {0}; - cJSON *c_vendor = cJSON_GetObjectItem(binfo, "vendor"); - if (c_vendor) { - char *bstr = cJSON_GetStringValue(binfo); - if (bstr) - strcpy(board, bstr); - } - cJSON *c_model = cJSON_GetObjectItem(binfo, "model"); - if (c_model) { - char *bstr = cJSON_GetStringValue(binfo); - strcpy(board_id, bstr); - strcat(board, " "); - strcat(board, bstr); + const char *bstr = + cJSON_GetStringValue(cJSON_GetObjectItem(binfo, "vendor")); + if (bstr) + snprintf(board, sizeof(board), "%s", bstr); + + bstr = cJSON_GetStringValue(cJSON_GetObjectItem(binfo, "model")); + if (bstr) { + snprintf(board_id, sizeof(board_id), "%s", bstr); + size_t used = strlen(board); + snprintf(board + used, sizeof(board) - used, " %s", bstr); } if (binfo) cJSON_Delete(binfo);