1 files changed, 25 insertions, 14 deletions

diff --git a/fw/fe310/eos/net/wifi.c b/fw/fe310/eos/net/wifi.c
index 113321b..ebbb9ca 100644
--- a/fw/fe310/eos/net/wifi.c
+++ b/fw/fe310/eos/net/wifi.c
@@ -44,16 +44,16 @@ eos_evt_handler_t eos_wifi_get_handler(unsigned char mtype) {
     return NULL;
 }
 
-int eos_wifi_status_parse(unsigned char *buffer, uint16_t len, uint8_t *status, uint8_t ip_addr[], char *ssid) {
+int eos_wifi_status_parse(unsigned char *buffer, uint16_t len, uint8_t *status, uint8_t ip_addr[], char *ssid, uint16_t ssid_size) {
     if (len < 2) return EOS_ERR_SIZE;
 
     if (buffer[0] != EOS_WIFI_MTYPE_STATUS) return EOS_ERR_NET;
     buffer++;
-    len -= 1;
+    len--;
 
     *status = buffer[0];
     buffer++;
-    len -= 1;
+    len--;
 
     switch (*status) {
         case EOS_WIFI_STATUS_GOT_IP:
@@ -62,15 +62,17 @@ int eos_wifi_status_parse(unsigned char *buffer, uint16_t len, uint8_t *status,
             buffer += sizeof(uint32_t);
             len -= sizeof(uint32_t);
         case EOS_WIFI_STATUS_CONNECTED:
-            if ((len == 0) || (len > EOS_WIFI_SIZE_SSID)) return EOS_ERR_SIZE;
-            buffer[len - 1] = '\0';
-            if (ssid) strcpy(ssid, buffer);
+            if (ssid) {
+                if ((len == 0) || (len > EOS_WIFI_SIZE_SSID) || (len > ssid_size - 1)) return EOS_ERR_SIZE;
+                memcpy(ssid, buffer, len);
+                ssid[len] = '\0';
+            }
             break;
     }
     return EOS_OK;
 }
 
-int eos_wifi_status(uint8_t *status, uint8_t ip_addr[], char *ssid, unsigned char *buffer) {
+int eos_wifi_status(uint8_t *status, uint8_t ip_addr[], char *ssid, uint16_t ssid_size, unsigned char *buffer) {
     unsigned char type;
     uint16_t len;
     int do_release;
@@ -93,7 +95,7 @@ int eos_wifi_status(uint8_t *status, uint8_t ip_addr[], char *ssid, unsigned cha
         rv = EOS_ERR_NET;
         goto wifi_status_fin;
     }
-    rv = eos_wifi_status_parse(buffer, len, status, ip_addr, ssid);
+    rv = eos_wifi_status_parse(buffer, len, status, ip_addr, ssid, ssid_size);
 
 wifi_status_fin:
     if (do_release) eos_net_free(buffer, 1);
@@ -146,8 +148,8 @@ int eos_wifi_connect(char *ssid, char *pwd, unsigned char *buffer, int sync) {
 
     ssid_len = strlen(ssid);
     pwd_len = strlen(pwd);
-    if (ssid_len > EOS_WIFI_SIZE_SSID - 1) return EOS_ERR_SIZE;
-    if (pwd_len > EOS_WIFI_SIZE_PWD - 1) return EOS_ERR_SIZE;
+    if (ssid_len > EOS_WIFI_SIZE_SSID) return EOS_ERR_SIZE;
+    if (pwd_len > EOS_WIFI_SIZE_PWD) return EOS_ERR_SIZE;
 
     if (buffer == NULL) {
         buffer = eos_net_alloc();
@@ -158,10 +160,19 @@ int eos_wifi_connect(char *ssid, char *pwd, unsigned char *buffer, int sync) {
     buf = buffer;
     buf[0] = EOS_WIFI_MTYPE_CONNECT;
     buf++;
-    strcpy(buf, ssid);
-    buf += ssid_len + 1;
-    strcpy(buf, pwd);
-    buf += pwd_len + 1;
+
+    *buf = ssid_len;
+    buf++;
+
+    memcpy(buf, ssid, ssid_len);
+    buf += ssid_len;
+
+    *buf = pwd_len;
+    buf++;
+
+    memcpy(buf, pwd, pwd_len);
+    buf += pwd_len;
+
     return _eos_net_send(EOS_NET_MTYPE_WIFI, buffer, 3 + ssid_len + pwd_len, async, 1);
 }