giomba
/
opensc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix possible infinite recursion (#2151) 

fixes https://github.com/OpenSC/OpenSC/issues/2149
This commit is contained in:
Frank Morgner 2020-11-25 09:27:28 +01:00 committed by GitHub
parent 0365c3ce6c
commit 480da424a5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/libopensc/card-oberthur.c
View File

@ -2206,6 +2206,9 @@ auth_read_record(struct sc_card *card, unsigned int nr_rec,
"auth_read_record(): nr_rec %i; count %"SC_FORMAT_LEN_SIZE_T"u",
nr_rec, count);
if (nr_rec > 0xFF)
LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_ARGUMENTS);
sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, 0xB2, nr_rec, 0);
apdu.p2 = (flags & SC_RECORD_EF_ID_MASK) << 3;
if (flags & SC_RECORD_BY_REC_NR)

3
src/libopensc/iso7816.c
View File

@ -172,6 +172,9 @@ iso7816_read_record(struct sc_card *card,
struct sc_apdu apdu;
int r;
if (rec_nr > 0xFF)
LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_ARGUMENTS);
sc_format_apdu(card, &apdu, SC_APDU_CASE_2, 0xB2, rec_nr, 0);
apdu.le = count;
apdu.resplen = count;

12
src/libopensc/pkcs15.c
View File

@ -2380,13 +2380,15 @@ sc_pkcs15_read_file(struct sc_pkcs15_card *p15card, const struct sc_path *in_pat
}
if (file->ef_structure == SC_FILE_EF_LINEAR_VARIABLE_TLV) {
int i;
unsigned int i;
size_t l, record_len;
unsigned char *head = data;
for (i=1; ; i++) {
for (i=1; ; i++) {
l = len - (head - data);
if (l > 256) { l = 256; }
if (l > 256) {
l = 256;
}
r = sc_read_record(p15card->card, i, head, l, SC_RECORD_BY_REC_NR);
if (r == SC_ERROR_RECORD_NOT_FOUND)
break;
@ -2397,13 +2399,13 @@ sc_pkcs15_read_file(struct sc_pkcs15_card *p15card, const struct sc_path *in_pat
break;
record_len = head[1];
if (record_len != 0xff) {
memmove(head,head+2,r-2);
memmove(head, head+2, r-2);
head += (r-2);
}
else {
if (r < 4)
break;
memmove(head,head+4,r-4);
memmove(head, head+4, r-4);
head += (r-4);
}
}