backup: read board vendor/model from the right cJSON nodes (#182)

do_upgrade() looked up the "vendor" and "model" items of the board info
object, then called cJSON_GetStringValue(binfo) on the *object* instead of
on the item it had just found. cJSON_GetStringValue() returns NULL for a
non-string, so:

  - the vendor branch was NULL-guarded and silently did nothing;
  - the model branch was not, and ran strcpy(board_id, NULL).

So `ipctool upgrade` segfaults on any board whose detector supplies a
"model" key — currently Ruision, Anjoy and Hankvision (src/boards/*.c) — and
on every other board it leaves board_id empty, so the "hardware" U-Boot
variable set from it further down never gets written.

Read the values from c_vendor/c_model, guard both against NULL, and bound
the copies with snprintf: the strings come from board detection (sysinfo
files, directory names) and were being strcpy/strcat'ed into fixed 1024-byte
buffers unchecked.

Behaviour is otherwise preserved, including board_id carrying the model
alone.

Note: `board` is assembled here but never read afterwards. That is
pre-existing, so left alone rather than silently changing what the composed
string is meant to be.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: widgetii

src/backup.c

@@ -880,18 +880,16 @@ static int do_upgrade(const char *filename, bool force) {
 
     cJSON *binfo = detect_board();
     char board[1024] = {0}, board_id[1024] = {0};
-    cJSON *c_vendor = cJSON_GetObjectItem(binfo, "vendor");
-    if (c_vendor) {
-        char *bstr = cJSON_GetStringValue(binfo);
-        if (bstr)
-            strcpy(board, bstr);
-    }
-    cJSON *c_model = cJSON_GetObjectItem(binfo, "model");
-    if (c_model) {
-        char *bstr = cJSON_GetStringValue(binfo);
-        strcpy(board_id, bstr);
-        strcat(board, " ");
-        strcat(board, bstr);
+    const char *bstr =
+        cJSON_GetStringValue(cJSON_GetObjectItem(binfo, "vendor"));
+    if (bstr)
+        snprintf(board, sizeof(board), "%s", bstr);
+
+    bstr = cJSON_GetStringValue(cJSON_GetObjectItem(binfo, "model"));
+    if (bstr) {
+        snprintf(board_id, sizeof(board_id), "%s", bstr);
+        size_t used = strlen(board);
+        snprintf(board + used, sizeof(board) - used, " %s", bstr);
     }
     if (binfo)
         cJSON_Delete(binfo);