From 0f979c9563bce27c4f41ccb4727865bcc6dc7d32 Mon Sep 17 00:00:00 2001
From: frankmorgner <frankmorgner@96b47cad-a561-4643-ad3b-153ac7d7599c>
Date: Fri, 2 Sep 2011 19:29:10 +0000
Subject: [PATCH] fixed problems parsing pin modification data structure

git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@520 96b47cad-a561-4643-ad3b-153ac7d7599c
---
 ccid/README.dox |  4 ++++
 ccid/src/ccid.c | 25 +++++++++++++++++++++++--
 ccid/src/ccid.h |  4 ----
 3 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/ccid/README.dox b/ccid/README.dox
index 26f64ff..b49d1e0 100644
--- a/ccid/README.dox
+++ b/ccid/README.dox
@@ -30,6 +30,10 @@ http://docs.openmoko.org/trac/ticket/2206). If you also want to switch multiple
 times between gadgetfs and g_ether, another patch is needed (see
 https://docs.openmoko.org/trac/ticket/2240).
 
+If you are using a more recent version of dummy_hcd, you maybe want to check
+out this patch:
+http://comments.gmane.org/gmane.linux.usb.general/47440
+
 
 @subsection o HINTS ON OPENSC
 
diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c
index 9d809af..aa2c5b9 100644
--- a/ccid/src/ccid.c
+++ b/ccid/src/ccid.c
@@ -1197,7 +1197,8 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle
             modify = (abPINDataStucture_Modification_t *)
                 (abData + sizeof(__u8));
 
-            if (abDatalen < sizeof *modify) {
+			/* bTeoPrologue adds another 3 bytes */
+            if (abDatalen < sizeof *modify + 3*(sizeof(__u8))) {
                 sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t");
                 sc_result = SC_ERROR_INVALID_DATA;
                 goto err;
@@ -1208,7 +1209,27 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle
             bmPINBlockString = modify->bmPINBlockString;
             bmFormatString = modify->bmFormatString;
             bNumberMessage = modify->bNumberMessage;
-            abPINApdu = (__u8*) modify + sizeof *modify;
+			/* bTeoPrologue adds another 3 bytes */
+            abPINApdu = (__u8*) modify + sizeof *modify + 3*(sizeof(__u8));
+            if (bNumberMessage != 0x00) {
+                /* bMsgIndex2 is present */
+                abPINApdu++;
+                if (abDatalen < sizeof *modify + 4*(sizeof(__u8))) {
+                    sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t");
+                    sc_result = SC_ERROR_INVALID_DATA;
+                    goto err;
+                }
+
+                if (bNumberMessage == 0x03) {
+                    /* bMsgIndex3 is present */
+                    abPINApdu++;
+                    if (abDatalen < sizeof *modify + 5*(sizeof(__u8))) {
+                        sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t");
+                        sc_result = SC_ERROR_INVALID_DATA;
+                        goto err;
+                    }
+                }
+            }
             apdulen = __le32_to_cpu(request->dwLength) - sizeof *modify - sizeof(__u8);
             break;
         case 0x10:
diff --git a/ccid/src/ccid.h b/ccid/src/ccid.h
index 5a8dc13..7cf7331 100644
--- a/ccid/src/ccid.h
+++ b/ccid/src/ccid.h
@@ -160,10 +160,6 @@ typedef struct {
     __u8   bNumberMessage;
     __le16 wLangId;
     __u8   bMsgIndex1;
-    __u8   bMsgIndex2;
-    __u8   bMsgIndex3;
-    __u8   bTeoPrologue1;
-    __le16 bTeoPrologue2;
 } __attribute__ ((packed)) abPINDataStucture_Modification_t;
 
 typedef struct {