ctdo
/
crashtest-r0ket
16
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sendcard: buffer overflow #fail

This commit is contained in:
schneider 2011-08-04 00:44:13 +02:00
parent 9124a186b9
commit b1d4bf019a
1 changed files with 34 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
firmware/l0dable/sendcard.c
View File

@ -30,12 +30,23 @@
//#include "lcd/print.h" //#include "lcd/print.h"
void sendFile(char *filename);
uint8_t mac[5] = {1,2,3,2,1}; uint8_t mac[5] = {1,2,3,2,1};
struct NRF_CFG config = {
.channel= 81,
.txmac= "\x1\x2\x3\x2\x1",
.nrmacs=1,
.mac0= "\x1\x2\x3\x2\x1",
.maclen ="\x20",
};
void ram(void) void ram(void)
{ {
nrf_config_set(&config);
char file[13]; char file[13];
selectFile(file,"TXT"); selectFile(file,"TXT");
sendFile(file); sendFile(file);
@ -43,18 +54,34 @@ void ram(void)
void sendR(uint8_t *rx, uint8_t *ry) void sendR(uint8_t *rx, uint8_t *ry)
{ {
uint8_t exp[2 + 4*NUMWORDS + 2]; //uint8_t exp[2 + 4*NUMWORDS + 2];
uint8_t exp[32];
exp[0] = 'R'; exp[0] = 'R';
for(int i=0; i<4*NUMWORDS; i++) for(int i=0; i<4*NUMWORDS; i++)
exp[2+i] = rx[i]; exp[2+i] = rx[i];
exp[1] = 'X'; exp[1] = 'X';
lcdPrintln("foo");
lcdRefresh();
nrf_snd_pkt_crc(32, exp); nrf_snd_pkt_crc(32, exp);
lcdPrintln("bar");
lcdRefresh();
delayms(10); delayms(10);
exp[1] = 'Y'; exp[1] = 'Y';
for(int i=0; i<4*NUMWORDS; i++) for(int i=0; i<4*NUMWORDS; i++)
exp[2+i] = ry[i]; exp[2+i] = ry[i];
lcdPrintln("foo");
lcdRefresh();
nrf_snd_pkt_crc(32, exp); nrf_snd_pkt_crc(32, exp);
lcdPrintln("bar");
lcdRefresh();
delayms(10); delayms(10);
lcdPrintln("bar");
lcdRefresh();
} }
int receiveKey(uint8_t type, uint8_t *x, uint8_t *y) int receiveKey(uint8_t type, uint8_t *x, uint8_t *y)
@ -169,9 +196,13 @@ void sendFile(char *filename)
ECIES_encyptkeygen(px, py, k1, k2, rx, ry); ECIES_encyptkeygen(px, py, k1, k2, rx, ry);
while( !done ){ while( !done ){
lcdPrintln("Sending file");lcdRefresh(); lcdPrintln("Sending fil");lcdRefresh();
sendR(rx,ry); sendR(rx,ry);
lcdPrintln("wait");
lcdRefresh();
delayms(3000); delayms(3000);
lcdPrintln("filetrans");
lcdRefresh();
filetransfer_send((uint8_t*)filename, 0, mac, (uint32_t*)k1); filetransfer_send((uint8_t*)filename, 0, mac, (uint32_t*)k1);
lcdPrintln("Done"); lcdPrintln("Done");
lcdPrintln("Right=OK"); lcdPrintln("Right=OK");