idprime: Use temporary variable instead of messing up the passed one
Thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
This commit is contained in:
parent
78cdab949f
commit
f015746d22
|
@ -418,6 +418,7 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
|
||||||
sc_path_t tinfo_path = {"\x00\x00", 2, 0, 0, SC_PATH_TYPE_PATH, {"", 0}};
|
sc_path_t tinfo_path = {"\x00\x00", 2, 0, 0, SC_PATH_TYPE_PATH, {"", 0}};
|
||||||
sc_file_t *file = NULL;
|
sc_file_t *file = NULL;
|
||||||
u8 buf[2];
|
u8 buf[2];
|
||||||
|
char *name;
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
LOG_FUNC_CALLED(card->ctx);
|
LOG_FUNC_CALLED(card->ctx);
|
||||||
|
@ -445,20 +446,22 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
|
||||||
}
|
}
|
||||||
sc_file_free(file);
|
sc_file_free(file);
|
||||||
|
|
||||||
*tname = malloc(buf[1]);
|
name = malloc(buf[1]);
|
||||||
if (*tname == NULL) {
|
if (name == NULL) {
|
||||||
LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY);
|
LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY);
|
||||||
}
|
}
|
||||||
|
|
||||||
r = iso_ops->read_binary(card, 2, (unsigned char *)*tname, buf[1], 0);
|
r = iso_ops->read_binary(card, 2, (unsigned char *)name, buf[1], 0);
|
||||||
if (r < 1) {
|
if (r < 1) {
|
||||||
free(*tname);
|
free(name);
|
||||||
LOG_FUNC_RETURN(card->ctx, r);
|
LOG_FUNC_RETURN(card->ctx, r);
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((*tname)[r-1] != '\0') {
|
if (name[r-1] != '\0') {
|
||||||
(*tname)[r-1] = '\0';
|
name[r-1] = '\0';
|
||||||
}
|
}
|
||||||
|
*tname = name;
|
||||||
|
|
||||||
LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);
|
LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue