Don't truncate received APDU when talking to pcsc-lite.

PR:		204552
Submitted by:	Marcin Cieslak <saper@saper.info>
This commit is contained in:
Alex Dupre 2017-04-10 12:14:50 +00:00
parent 716557cd23
commit b4859c7285
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=438157
2 changed files with 51 additions and 1 deletions

View File

@ -3,7 +3,7 @@
PORTNAME= openct
PORTVERSION= 0.6.20
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= security
MASTER_SITES= SF/opensc/${PORTNAME}

View File

@ -0,0 +1,50 @@
--- src/pcsc/pcsc.c.orig 2007-05-25 21:11:45 UTC
+++ src/pcsc/pcsc.c
@@ -25,6 +25,7 @@
#ifdef DEBUG_IFDH
#include <syslog.h>
#endif
+#include <limits.h>
#ifdef __APPLE__
#include <PCSC/wintypes.h>
#include <PCSC/pcsclite.h>
@@ -390,6 +391,10 @@ IFDHTransmitToICC(DWORD Lun, SCARD_IO_HE
ctn = ((unsigned short)(Lun >> 16)) % IFDH_MAX_READERS;
slot = ((unsigned short)(Lun & 0x0000FFFF)) % IFDH_MAX_SLOTS;
+ if (TxLength > USHRT_MAX) {
+ (*RxLength) = 0;
+ return IFD_PROTOCOL_NOT_SUPPORTED;
+ }
#ifdef HAVE_PTHREAD
pthread_mutex_lock(&ifdh_context_mutex[ctn]);
#endif
@@ -399,7 +404,7 @@ IFDHTransmitToICC(DWORD Lun, SCARD_IO_HE
#endif
dad = (UCHAR) ((slot == 0) ? 0x00 : slot + 1);
sad = 0x02;
- lr = (unsigned short)(*RxLength);
+ lr = (*RxLength > USHRT_MAX) ? USHRT_MAX : (unsigned short)(*RxLength);
lc = (unsigned short)TxLength;
ret = CT_data(ctn, &dad, &sad, lc, TxBuffer, &lr, RxBuffer);
@@ -438,6 +443,10 @@ IFDHControl(DWORD Lun, PUCHAR TxBuffer,
ctn = ((unsigned short)(Lun >> 16)) % IFDH_MAX_READERS;
slot = ((unsigned short)(Lun & 0x0000FFFF)) % IFDH_MAX_SLOTS;
+ if (TxLength > USHRT_MAX) {
+ (*RxLength) = 0;
+ return IFD_PROTOCOL_NOT_SUPPORTED;
+ }
#ifdef HAVE_PTHREAD
pthread_mutex_lock(&ifdh_context_mutex[ctn]);
#endif
@@ -447,7 +456,7 @@ IFDHControl(DWORD Lun, PUCHAR TxBuffer,
#endif
dad = 0x01;
sad = 0x02;
- lr = (unsigned short)(*RxLength);
+ lr = (*RxLength > USHRT_MAX) ? USHRT_MAX : (unsigned short)(*RxLength);
lc = (unsigned short)TxLength;
ret = CT_data(ctn, &dad, &sad, lc, TxBuffer, &lr, RxBuffer);