Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-29 02:38:22 -05:00
Code Issues Projects Releases Wiki Activity

PCSC: Make AID copying easier for static analyzers

Browse Source 
Use a separate pointer and length field instead of trying to copy from a
struct field that has only part of the full buffer available.
(CID 68115)

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-05 23:18:56 +02:00
parent c397eff828
commit f27f1644a8
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/utils/pcsc_funcs.c
View File

@ -402,10 +402,12 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
unsigned char rid[5]; unsigned char rid[5];
unsigned char appl_code[2]; /* 0x1002 for 3G USIM */ unsigned char appl_code[2]; /* 0x1002 for 3G USIM */
} *efdir; } *efdir;
unsigned char buf[127]; unsigned char buf[127], *aid_pos;
size_t blen; size_t blen;
unsigned int aid_len = 0;
efdir = (struct efdir *) buf; efdir = (struct efdir *) buf;
aid_pos = &buf[4];
blen = sizeof(buf); blen = sizeof(buf);
if (scard_select_file(scard, SCARD_FILE_EF_DIR, buf, &blen)) { if (scard_select_file(scard, SCARD_FILE_EF_DIR, buf, &blen)) {
wpa_printf(MSG_DEBUG, "SCARD: Failed to read EF_DIR"); wpa_printf(MSG_DEBUG, "SCARD: Failed to read EF_DIR");
@ -454,14 +456,15 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
continue; continue;
} }
if (efdir->aid_len < 1 || efdir->aid_len > 16) { aid_len = efdir->aid_len;
wpa_printf(MSG_DEBUG, "SCARD: Invalid AID length %d", if (aid_len < 1 || aid_len > 16) {
efdir->aid_len); wpa_printf(MSG_DEBUG, "SCARD: Invalid AID length %u",
aid_len);
continue; continue;
} }
wpa_hexdump(MSG_DEBUG, "SCARD: AID from EF_DIR record", wpa_hexdump(MSG_DEBUG, "SCARD: AID from EF_DIR record",
efdir->rid, efdir->aid_len); aid_pos, aid_len);
if (efdir->appl_code[0] == 0x10 && if (efdir->appl_code[0] == 0x10 &&
efdir->appl_code[1] == 0x02) { efdir->appl_code[1] == 0x02) {
@ -477,14 +480,14 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
return -1; return -1;
} }
if (efdir->aid_len > maxlen) { if (aid_len > maxlen) {
wpa_printf(MSG_DEBUG, "SCARD: Too long AID"); wpa_printf(MSG_DEBUG, "SCARD: Too long AID");
return -1; return -1;
} }
os_memcpy(aid, efdir->rid, efdir->aid_len); os_memcpy(aid, aid_pos, aid_len);
return efdir->aid_len; return aid_len;
} }