VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixed memory corruption for too long _RDR_to_PC_DataBlock packages

Browse Source 
git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@261 96b47cad-a561-4643-ad3b-153ac7d7599c
This commit is contained in:
frankmorgner
2010-09-13 09:24:19 +00:00
parent 2264fd2dab
commit 211dc10583
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ccid/src/ccid.c
View File

@@ -321,6 +321,7 @@ get_RDR_to_PC_SlotStatus(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, si
if (!status)
return SC_ERROR_OUT_OF_MEMORY;
*outbuf = (__u8 *) status;
*outlen = sizeof(*status) + abProtocolDataStructureLen;
status->bMessageType = 0x81;
status->dwLength = __constant_cpu_to_le32(abProtocolDataStructureLen);
@@ -332,8 +333,6 @@ get_RDR_to_PC_SlotStatus(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, si
memcpy((*outbuf) + sizeof(*status), abProtocolDataStructure, abProtocolDataStructureLen);
*outlen = sizeof(*status) + abProtocolDataStructureLen;
return SC_SUCCESS;
}
@@ -349,10 +348,11 @@ get_RDR_to_PC_DataBlock(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf,
return SC_ERROR_INVALID_DATA;
}
RDR_to_PC_DataBlock_t *data = realloc(*outbuf, sizeof *data);
RDR_to_PC_DataBlock_t *data = realloc(*outbuf, sizeof(*data) + abDataLen);
if (!data)
return SC_ERROR_OUT_OF_MEMORY;
*outbuf = (__u8 *) data;
*outlen = sizeof(*data) + abDataLen;
data->bMessageType = 0x80;
data->dwLength = __constant_cpu_to_le32(abDataLen);
@@ -364,8 +364,6 @@ get_RDR_to_PC_DataBlock(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf,
memcpy((*outbuf) + sizeof(*data), abData, abDataLen);
*outlen = sizeof(*data) + abDataLen;
return SC_SUCCESS;
}
@@ -865,7 +863,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card,
2+pace_output.ef_cardaccess_length + /* EF.CardAccess */
1+pace_output.recent_car_length + /* Most recent CAR */
1+pace_output.previous_car_length + /* Previous CAR */
2+pace_output.id_icc_length); /* XXX */
2+pace_output.id_icc_length); /* identifier of the MRTD chip */
if (!p)
return SC_ERROR_OUT_OF_MEMORY;
*abDataOut = p;