The vulnerable function.

do_upgrade_post.c

/* WARNING: Control flow encountered bad instruction data */
/* WARNING: Exceeded maximum restarts with more pending */

void do_upgrade_post(void *param_1,BIO *param_2,int param_3)

{
  undefined *puVar1;
  int iVar2;
  size_t sVar3;
  int iVar4;
  char *pcVar5;
  uint uVar6;
  undefined4 uVar7;
  int local_res8 [2];
  char acStack1112 [1024];
  char acStack88 [64];
  undefined4 local_8;
  
  local_8 = 0x1000dc80;
  DAT_100069a0 = 0x16;
  local_res8[0] = param_3;
  system("cp /www/Success_u_s.asp /tmp/.");
  system("cp /www/Fail_u_s.asp /tmp/.");
  memset(acStack88,0,0x40);
  puVar1 = (undefined *)nvram_get("ui_language");
  uVar7 = 0;
  if (puVar1 == (undefined *)0x0) {
    puVar1 = &DAT_0047a2b8;
  }
  snprintf(acStack88,0x40,"cp /www/%s_lang_pack/captmp.js /tmp/.",puVar1);
  system(acStack88);
  iVar2 = memcmp(param_1,"restore.cgi",0xb);
  DAT_100050c0 = (uint)(iVar2 == 0);
  iVar2 = local_res8[0];
  do {
    do {
      if (iVar2 < 1) goto joined_r0x0041aebc;
      uVar6 = iVar2 + 1;
      if (0x400 < uVar6) {
        uVar6 = 0x400;
      }
      iVar2 = wfgets(acStack1112,uVar6,param_2);
      if (iVar2 == 0) {
        return;
      }
      sVar3 = strlen(acStack1112);
      iVar2 = local_res8[0] - sVar3;
      local_res8[0] = iVar2;
      iVar4 = strncasecmp(acStack1112,"Content-Disposition:",0x14);
    } while (iVar4 != 0);
    pcVar5 = strstr(acStack1112,"name=\"file\"");
    if (pcVar5 != (char *)0x0) {
      uVar7 = 2;
      goto joined_r0x0041aebc;
    }
    pcVar5 = strstr(acStack1112,"name=\"restore\"");
  } while (pcVar5 == (char *)0x0);
  uVar7 = 1;
joined_r0x0041aebc:
  do {
    if (iVar2 < 1) {
LAB_0041afc0:
      DAT_100069a0 = sys_upgrade(0,param_2,local_res8,uVar7);
      while (local_res8[0] = local_res8[0] + -1, local_res8[0] != -1) {
        if (do_ssl == 0) {
          fgetc();
        }
        else {
          BIO_gets(param_2,acStack1112,1);
        }
      }
                    /* WARNING: Bad instruction - Truncating control flow here */
      halt_baddata();
    }
    uVar6 = iVar2 + 1;
    if (0x400 < uVar6) {
      uVar6 = 0x400;
    }
    iVar2 = wfgets(acStack1112,uVar6,param_2);
    if (iVar2 == 0) {
      return;
    }
    sVar3 = strlen(acStack1112);
    local_res8[0] = local_res8[0] - sVar3;
    iVar2 = memcmp(acStack1112,&DAT_0047a324,2);
    if ((iVar2 == 0) ||
       (iVar4 = memcmp(acStack1112,&DAT_0047a328,3), iVar2 = local_res8[0], iVar4 == 0))
    goto LAB_0041afc0;
  } while( true );
}