changes

Makefile

@@ -21,7 +21,7 @@ LIBS += $(DEP)/lib/libmbedtls.a $(DEP)/lib/libmbedcrypto.a $(DEP)/lib/libmbedx50
 LIBS += $(DEP)/lib/libusb-1.0.a
 
 ifeq ($(DEV_BUILD),1)
-CFLAGS += -O0 -g -DDEV_BUILD
+CFLAGS += -O0 -g -DDEV_BUILD -fsanitize=address -fno-omit-frame-pointer -fsanitize-address-use-after-return=runtime
 else
 CFLAGS += -Os -g
 endif

src/exec_checkra1n.c

@@ -44,9 +44,9 @@ void exec_checkra1n() {
 		unlink(checkra1n_path);
 	}
 	char args[0x10] = "-pE";
-	if (demote) strcat(args, "d");
-	if (verbose >= 2) strcat(args, "v");
-	if (pongo_path != NULL) strcat(args, "k"); // keep this at last
+	if (demote) strncat(args, "d", 0x10);
+	if (verbose >= 2) strncat(args, "v", 0x10);
+	if (pongo_path != NULL) strncat(args, "k", 0x10); // keep this at last
 	pid_t pid;
 	char* checkra1n_argv[] = {
 		checkra1n_path,

src/lockdown_helper.c

@@ -103,7 +103,7 @@ static char* _send_request_and_get_reply(int fd, const char* request, uint32_t l
 int lockdown_check_type(int fd, const char* type_match)
 {
 	unsigned char tmp[512];
-	uint32_t len = (uint32_t)sprintf((char*)tmp, QUERY_TYPE_REQUEST);
+	uint32_t len = (uint32_t)snprintf((char*)tmp, 512, QUERY_TYPE_REQUEST);
 	uint32_t belen = htonl(len-4);
 	*(uint32_t*)tmp = belen;
 	uint32_t resp_size = 0;
@@ -124,9 +124,9 @@ int lockdown_get_uint_value(int fd, const char* domain, const char* key, uint64_
 	char tmp[1024];
 	uint32_t len;
 	if (domain) {
-		len = sprintf(tmp, GET_VALUE_DOMAIN_REQUEST_FMT, domain, key);
+		len = snprintf(tmp, 1024, GET_VALUE_DOMAIN_REQUEST_FMT, domain, key);
 	} else {
-		len = sprintf(tmp, GET_VALUE_REQUEST_FMT, key);
+		len = snprintf(tmp, 1024, GET_VALUE_REQUEST_FMT, key);
 	}
 	*(uint32_t*)&tmp = htonl(len-4);
 
@@ -164,9 +164,9 @@ int lockdown_get_string_value(int fd, const char* domain, const char* key, char*
 	char tmp[1024];
 	uint32_t len;
 	if (domain) {
-		len = sprintf(tmp, GET_VALUE_DOMAIN_REQUEST_FMT, domain, key);
+		len = snprintf(tmp, 1024, GET_VALUE_DOMAIN_REQUEST_FMT, domain, key);
 	} else {
-		len = sprintf(tmp, GET_VALUE_REQUEST_FMT, key);
+		len = snprintf(tmp, 1024, GET_VALUE_REQUEST_FMT, key);
 	}
 	*(uint32_t*)&tmp = htonl(len-4);
 
@@ -215,7 +215,7 @@ int lockdown_get_string_value(int fd, const char* domain, const char* key, char*
 int lockdown_enter_recovery(int fd)
 {
 	char tmp[512];
-	uint32_t len = (uint32_t)sprintf(tmp, ENTER_RECOVERY_REQUEST);
+	uint32_t len = (uint32_t)snprintf(tmp, 512, ENTER_RECOVERY_REQUEST);
 	*(uint32_t*)&tmp = htonl(len-4);
 	uint32_t resp_size = 0;
 	char* resp = _send_request_and_get_reply(fd, tmp, len, &resp_size);

src/main.c

@@ -82,7 +82,7 @@ int build_checks() {
 
 bool dfuhelper_only = false, pongo_exit = false, start_from_pongo = false, palerain_version = false;
 
-int main(int argc, char *argv[]) {
+int palera1n(int argc, char *argv[]) {
 	int ret = 0;
 	pthread_mutex_init(&log_mutex, NULL);
 	if ((ret = build_checks())) return ret;
@@ -147,3 +147,7 @@ cleanup:
 	}
 	return ret;
 }
+
+int main (int argc, char* argv[]) {
+	return palera1n(argc, argv);
+}

src/pongo_helper.c

@@ -44,7 +44,7 @@ void *pongo_usb_callback(void *arg) {
 		issue_pongo_command(handle, rootfs_cmd);
 		issue_pongo_command(handle, dtpatch_cmd);
 	}
-	strcat(xargs_cmd, " rootdev=md0");
+	strncat(xargs_cmd, " rootdev=md0", 0x270);
 	upload_pongo_file(handle, **ramdisk_to_upload, ramdisk_dmg_len);
 	issue_pongo_command(handle, "ramdisk");
 	upload_pongo_file(handle, **overlay_to_upload, binpack_dmg_len);