Changeset 8346

Timestamp:

02/12/13 02:58:23 (10 years ago)

Author:

gf

Message:

csctapi/protocol_t0: Fix possible use of uninitialized data.

The bug was found by Gorgone.

File:

• trunk/csctapi/protocol_t0.c (modified) (3 diffs)

trunk/csctapi/protocol_t0.c

@@ -270 +270 @@
     unsigned char buffer[PROTOCOL_T0_MAX_SHORT_COMMAND];
     unsigned char tpdu_rsp[CTA_RES_LEN];
+    memset(tpdu_rsp, 0, sizeof(tpdu_rsp));
     uint16_t tpdu_lr = 0;
     int32_t Le;
@@ -289 +290 @@
     {
         Le = ((((uint32_t)(command[command_len - 2]) << 8) | command[command_len - 1]) == 0 ? 65536 : (((uint32_t)(command[command_len - 2]) << 8) | command[command_len - 1]));
-        if (tpdu_rsp[tpdu_lr - 2] == 0x61)
+        if (tpdu_lr > 1 && tpdu_rsp[tpdu_lr - 2] == 0x61)
         {
             /* Lm == (Le - APDU_Rsp_RawLen (tpdu_rsp)) == 0 */
@@ -308 +309 @@
             ret = Protocol_T0_Case3E (reader, buffer, rsp, lr);
         }
-        else if ((tpdu_rsp[tpdu_lr - 2] & 0xF0) == 0x60)
+        else if (tpdu_lr > 1 && (tpdu_rsp[tpdu_lr - 2] & 0xF0) == 0x60)
         {
             /* Map response TPDU onto APDU without change */