NetGear R系列多款路由器远程命令注入漏洞分析

if ( v25 )
strcpy((char *)&v50, v20);
}
else
{
strncpy((char *)&v50, v20, v22 - 1 - v21);// v50=;kill
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
printf("\r\n#############tmp1=%s,tmp2=%s,tmp3=%s,cgi=%s\r\n", v12, v21, v22, &v50);
v15 = &v46;
strcpy((char *)&v46, v22);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
{
v16 = "\r\n###############%s(%d)path_info=%s\r\n";
v17 = 110;
v18 = "netgear_commonCgi";
goto LABEL_34;
}
}
}
}
LABEL_40:
if ( v7 )
{
if ( v7 == 1 )
{
v26 = "POST";
v27 = (char *)&v53;
}
else
{
if ( v7 != 2 )
{
LABEL_47:
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
printf("\r\n###############%s(%d)request_method=%s\r\n", "netgear_commonCgi", 130, &v53);
if ( (_BYTE)v46 )
setenv("PATH_INFO", (const char *)&v46, 1);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
{
v28 = getenv("PATH_INFO");
printf("\r\n###############%s(%d)PATH_INFO=%s\r\n", "netgear_commonCgi", 136, v28);
}
setenv("LD_LIBRARY_PATH", "/usr/lib", 1);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
{
v29 = getenv("LD_LIBRARY_PATH");
printf("\r\n###############%s(%d)LD_LIBRARY_PATH=%s\r\n", "netgear_commonCgi", 140, v29);
}
setenv("REQUEST_METHOD", (const char *)&v53, 1);
if ( acosNvramConfig_match((int)&unk_F0378, (int)"2") )
{
v30 = getenv("REQUEST_METHOD");
printf("\r\n###############%s(%d)REQUEST_METHOD=%s\r\n", "netgear_commonCgi", 144, v30);
}
if ( (_BYTE)v47 )
setenv("QUERY_STRING", (const char *)&v47, 1);
if ( !strcmp((const char *)&v53, "POST") )
{
v31 = fopen("/tmp/post_result", "r");