1 files changed, 20 insertions, 9 deletions

diff --git a/fw/esp32/components/eos/cell_pdp.c b/fw/esp32/components/eos/cell_pdp.c
index d04b66b..9ff3ed7 100644
--- a/fw/esp32/components/eos/cell_pdp.c
+++ b/fw/esp32/components/eos/cell_pdp.c
@@ -7,20 +7,28 @@
 #include "net.h"
 #include "cell.h"
 
-void eos_cell_pdp_handler(unsigned char mtype, unsigned char *buffer, uint16_t buf_len) {
+void eos_cell_pdp_handler(unsigned char _mtype, EOSMessage *msg, uint16_t len) {
+    unsigned char mtype;
+    unsigned char *buffer = msg->buffer;
+
+    if (len < 1) return;
+
+    mtype = buffer[0] & ~EOS_CELL_MTYPE_MASK;
+
     switch (mtype) {
         case EOS_CELL_MTYPE_PDP_SET_APN:
         case EOS_CELL_MTYPE_PDP_SET_USR:
         case EOS_CELL_MTYPE_PDP_SET_PWD: {
-            char *arg;
+            char arg[EOS_CELL_PDP_SIZE_ARG + 1];
 
             buffer++;
-            buf_len--;
+            len--;
 
-            arg = (char *)buffer;
-            if (buf_len > EOS_CELL_PDP_SIZE_ARG) break;
+            if (len > EOS_CELL_PDP_SIZE_ARG) break;
+
+            memcpy(arg, buffer, len);
+            arg[len] = '\0';
 
-            buffer[buf_len] = '\0';
             switch (mtype) {
                 case EOS_CELL_MTYPE_PDP_SET_APN: {
                     eos_ppp_set_apn(arg);
@@ -43,10 +51,12 @@ void eos_cell_pdp_handler(unsigned char mtype, unsigned char *buffer, uint16_t b
         case EOS_CELL_MTYPE_PDP_GET_APN:
         case EOS_CELL_MTYPE_PDP_GET_USR:
         case EOS_CELL_MTYPE_PDP_GET_PWD: {
-            char *arg;
+            char arg[EOS_CELL_PDP_SIZE_ARG + 1];
+
+            if (!(eos_msg_flags(msg) & EOS_MSG_FLAG_RPLY_REQ)) break;
+            if (msg->size < EOS_CELL_PDP_SIZE_ARG + 1) break;
 
             buffer[0] = EOS_CELL_MTYPE_PDP | mtype;
-            arg = (char *)(buffer + 1);
             switch (mtype) {
                 case EOS_CELL_MTYPE_PDP_GET_APN: {
                     eos_ppp_get_apn(arg);
@@ -63,8 +73,9 @@ void eos_cell_pdp_handler(unsigned char mtype, unsigned char *buffer, uint16_t b
                     break;
                 }
             }
+            memcpy(buffer + 1, arg, strlen(arg));
 
-            eos_net_reply(EOS_NET_MTYPE_CELL, buffer, strlen(arg) + 1);
+            eos_net_reply(EOS_NET_MTYPE_CELL, msg, strlen(arg) + 1);
             break;
         }