VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixed parsing of bNumberMessage and response buffer for boxing error

Browse Source
This commit is contained in:
Frank Morgner
2013-06-20 21:02:25 +02:00
parent f657454ed3
commit 1a97573286
1 changed files with 11 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
ccid/src/ccid.c
View File

@@ -195,7 +195,7 @@ static int get_rapdu(sc_apdu_t *apdu, __u8 **buf, size_t *resplen)
} }
*buf = apdu->resp; *buf = apdu->resp;
if (apdu->cla == 0XFF) { if (apdu->cla == 0xff) {
sc_result = perform_pseudo_apdu(card->reader, apdu); sc_result = perform_pseudo_apdu(card->reader, apdu);
} else { } else {
sc_result = sc_transmit_apdu(card, apdu); sc_result = sc_transmit_apdu(card, apdu);
@@ -527,6 +527,7 @@ perform_pseudo_apdu(sc_reader_t *reader, sc_apdu_t *apdu)
if (!reader || !apdu || apdu->cla != 0xff) if (!reader || !apdu || apdu->cla != 0xff)
return SC_ERROR_INVALID_ARGUMENTS; return SC_ERROR_INVALID_ARGUMENTS;
apdu->resplen = 0;
switch (apdu->ins) { switch (apdu->ins) {
case 0x9A: case 0x9A:
@@ -534,7 +535,6 @@ perform_pseudo_apdu(sc_reader_t *reader, sc_apdu_t *apdu)
case 0x01: case 0x01:
/* GetReaderInfo */ /* GetReaderInfo */
if (apdu->datalen != 0) { if (apdu->datalen != 0) {
apdu->resplen = 0;
apdu->sw1 = iso_sw_incorrect_p1_p2.sw1; apdu->sw1 = iso_sw_incorrect_p1_p2.sw1;
apdu->sw2 = iso_sw_incorrect_p1_p2.sw2; apdu->sw2 = iso_sw_incorrect_p1_p2.sw2;
goto err; goto err;
@@ -563,7 +563,6 @@ perform_pseudo_apdu(sc_reader_t *reader, sc_apdu_t *apdu)
memcpy(apdu->resp, Treiberversion, apdu->resplen); memcpy(apdu->resp, Treiberversion, apdu->resplen);
break; break;
default: default:
apdu->resplen = 0;
apdu->sw1 = iso_sw_ref_data_not_found.sw1; apdu->sw1 = iso_sw_ref_data_not_found.sw1;
apdu->sw2 = iso_sw_ref_data_not_found.sw2; apdu->sw2 = iso_sw_ref_data_not_found.sw2;
goto err; goto err;
@@ -572,7 +571,7 @@ perform_pseudo_apdu(sc_reader_t *reader, sc_apdu_t *apdu)
case 0x04: case 0x04:
switch (apdu->p2) { switch (apdu->p2) {
case 0x04: case 0x10:
/* VerifyPIN/ModifyPIN */ /* VerifyPIN/ModifyPIN */
LOG_TEST_RET(ctx, LOG_TEST_RET(ctx,
perform_PC_to_RDR_Secure(apdu->data, apdu->datalen, &apdu->resp, &apdu->resplen), perform_PC_to_RDR_Secure(apdu->data, apdu->datalen, &apdu->resp, &apdu->resplen),
@@ -1296,26 +1295,17 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle
/* bTeoPrologue adds another 3 bytes */ /* bTeoPrologue adds another 3 bytes */
abPINApdu = (__u8*) modify + sizeof *modify + 3*(sizeof(__u8)); abPINApdu = (__u8*) modify + sizeof *modify + 3*(sizeof(__u8));
apdulen = __le32_to_cpu(request->dwLength) - sizeof *modify - 4*sizeof(__u8); apdulen = __le32_to_cpu(request->dwLength) - sizeof *modify - 4*sizeof(__u8);
if (bNumberMessage != 0x00) { switch (bNumberMessage) {
/* bMsgIndex2 is present */ case 0x03:
abPINApdu++;
apdulen--;
if (abDatalen < sizeof *modify + 4*(sizeof(__u8))) {
sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t");
sc_result = SC_ERROR_INVALID_DATA;
goto err;
}
if (bNumberMessage == 0x03) {
/* bMsgIndex3 is present */ /* bMsgIndex3 is present */
abPINApdu++; abPINApdu++;
apdulen--; apdulen--;
if (abDatalen < sizeof *modify + 5*(sizeof(__u8))) { /* fall through */
sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t"); case 0x02:
sc_result = SC_ERROR_INVALID_DATA; /* bMsgIndex2 is present */
goto err; abPINApdu++;
} apdulen--;
} break;
} }
break; break;
case 0x10: case 0x10: