From 211dc1058328146c96b3e08a3de4624dfda61ec4 Mon Sep 17 00:00:00 2001
From: frankmorgner <frankmorgner@96b47cad-a561-4643-ad3b-153ac7d7599c>
Date: Mon, 13 Sep 2010 09:24:19 +0000
Subject: [PATCH] fixed memory corruption for too long _RDR_to_PC_DataBlock
 packages

git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@261 96b47cad-a561-4643-ad3b-153ac7d7599c
---
 ccid/src/ccid.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c
index 6849cd7..0836bfc 100644
--- a/ccid/src/ccid.c
+++ b/ccid/src/ccid.c
@@ -321,6 +321,7 @@ get_RDR_to_PC_SlotStatus(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, si
     if (!status)
         return SC_ERROR_OUT_OF_MEMORY;
     *outbuf = (__u8 *) status;
+    *outlen = sizeof(*status) + abProtocolDataStructureLen;
 
     status->bMessageType = 0x81;
     status->dwLength     = __constant_cpu_to_le32(abProtocolDataStructureLen);
@@ -332,8 +333,6 @@ get_RDR_to_PC_SlotStatus(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, si
 
     memcpy((*outbuf) + sizeof(*status), abProtocolDataStructure, abProtocolDataStructureLen);
 
-    *outlen = sizeof(*status) + abProtocolDataStructureLen;
-
     return SC_SUCCESS;
 }
 
@@ -349,10 +348,11 @@ get_RDR_to_PC_DataBlock(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf,
         return SC_ERROR_INVALID_DATA;
     }
 
-    RDR_to_PC_DataBlock_t *data = realloc(*outbuf, sizeof *data);
+    RDR_to_PC_DataBlock_t *data = realloc(*outbuf, sizeof(*data) + abDataLen);
     if (!data)
         return SC_ERROR_OUT_OF_MEMORY;
     *outbuf = (__u8 *) data;
+    *outlen = sizeof(*data) + abDataLen;
 
     data->bMessageType    = 0x80;
     data->dwLength        = __constant_cpu_to_le32(abDataLen);
@@ -364,8 +364,6 @@ get_RDR_to_PC_DataBlock(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf,
 
     memcpy((*outbuf) + sizeof(*data), abData, abDataLen);
 
-    *outlen = sizeof(*data) + abDataLen;
-
     return SC_SUCCESS;
 }
 
@@ -865,7 +863,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
             2+pace_output.ef_cardaccess_length +    /* EF.CardAccess */
             1+pace_output.recent_car_length +       /* Most recent CAR */
             1+pace_output.previous_car_length +     /* Previous CAR */
-            2+pace_output.id_icc_length);           /* XXX */
+            2+pace_output.id_icc_length);           /* identifier of the MRTD chip */
     if (!p)
         return SC_ERROR_OUT_OF_MEMORY;
     *abDataOut = p;