Quectel Delta Radio Firmware Upgrade support - libmts-io implementation

Added more strict handling for comma-separated data in URC messages to prevent out-of-bounds reads.

2 files changed, 15 insertions, 4 deletions

diff --git a/include/mts/MTS_IO_QuectelRadio.h b/include/mts/MTS_IO_QuectelRadio.h
index 41c89dc..58e3d25 100644
--- a/include/mts/MTS_IO_QuectelRadio.h
+++ b/include/mts/MTS_IO_QuectelRadio.h
@@ -82,8 +82,18 @@ namespace MTS {
                 static uint16_t getQuectelChecksum(const void* data, size_t nBytes);
                 static inline void updateQuectelChecksum(uint16_t& iChecksum, uint16_t iNewFragment);
                 static inline uint16_t bytesToUint16(uint8_t high, uint8_t low);
+
                 CODE fumoWaitUpgradeFinished(UpdateCb& stepCb);
                 CODE fumoWaitNewFirmware(UpdateCb& stepCb);
+
+                /// Get value from container by its index, use default value if not found. Non-template version.
+                const std::string& getByIndex(const std::vector<std::string>& vector, size_t index, const std::string& defaultValue) {
+                    if (index >= vector.size()) {
+                        return defaultValue;
+                    } else {
+                        return vector[index];
+                    }
+                }
         };
     }
 }
diff --git a/src/MTS_IO_QuectelRadio.cpp b/src/MTS_IO_QuectelRadio.cpp
index 39c0601..59170fe 100644
--- a/src/MTS_IO_QuectelRadio.cpp
+++ b/src/MTS_IO_QuectelRadio.cpp
@@ -1016,11 +1016,12 @@ ICellularRadio::CODE QuectelRadio::fumoWaitUpgradeFinished(ICellularRadio::Updat
         }
 
         const auto vParts = MTS::Text::split(MTS::Text::trim(sResponse), ',', 3);
-        const std::string& sStage = vParts[1];
+        const std::string& sStage = getByIndex(vParts, 1, "NOT_DEFINED");
+
         if (sStage == sFotaUrcEnd) {
             // FOTA finished
             printTrace("Got FOTA END message");
-            const std::string& sCode = vParts[2];
+            const std::string& sCode = getByIndex(vParts, 2, "-1");
 
             if (sCode == "0") {
                 // finished successfully
@@ -1034,11 +1035,11 @@ ICellularRadio::CODE QuectelRadio::fumoWaitUpgradeFinished(ICellularRadio::Updat
             printTrace("Got FOTA START message");
         } else if (sStage == sFotaUrcProgress) {
             printTrace("Got FOTA progress message");
-            const std::string& sPercents = vParts[2];
+            const std::string& sPercents = getByIndex(vParts, 2, "0");
             printInfo("FOTA progress: [%s]", sPercents.c_str());
             callNextStep(stepCb, "FUMO Info: firmware apply progress " + sPercents);
         } else {
-            printInfo("FOTA unexpected URC code: [%s]", sStage.c_str());
+            printInfo("FOTA unexpected URC code: [%s]", sResponse.c_str());
         }
     }