giomba/opensc
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

simpletlv: Avoid writing before all sanity checks in sc_simpletlv_put_tag()

Browse Source
This commit is contained in:
Jakub Jelen 2019-11-15 18:35:41 +01:00
parent b0d3a70b91
commit 8fd5ffd54e
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/libopensc/simpletlv.c
View File

@ -49,19 +49,20 @@ sc_simpletlv_put_tag(u8 tag, size_t datalen, u8 *out, size_t outlen, u8 **ptr)
/* tag is just number between 0x01 and 0xFE */ /* tag is just number between 0x01 and 0xFE */
if (tag == 0x00 || tag == 0xff) if (tag == 0x00 || tag == 0xff)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
if (datalen > 0xffff) {
/* we can't store more than two bytes in Simple TLV */
return SC_ERROR_WRONG_LENGTH;
}
*p++ = tag; /* tag is single byte */ *p++ = tag; /* tag is single byte */
if (datalen < 0xff) { if (datalen < 0xff) {
/* short value up to 255 */ /* short value up to 255 */
*p++ = (u8)datalen; /* is in the second byte */ *p++ = (u8)datalen; /* is in the second byte */
} else if (datalen < 0xffff) { } else {
/* longer values up to 65535 */ /* longer values up to 65535 */
*p++ = (u8)0xff; /* first byte is 0xff */ *p++ = (u8)0xff; /* first byte is 0xff */
*p++ = (u8)datalen & 0xff; *p++ = (u8)datalen & 0xff;
*p++ = (u8)(datalen >> 8) & 0xff; /* LE */ *p++ = (u8)(datalen >> 8) & 0xff; /* LE */
} else {
/* we can't store more than two bytes in Simple TLV */
return SC_ERROR_WRONG_LENGTH;
} }
if (ptr != NULL) if (ptr != NULL)
*ptr = p; *ptr = p;