From c63cc40c34b44193c4cb8f9a97fb30c9680ebd0f Mon Sep 17 00:00:00 2001
From: Frank Morgner <frankmorgner@gmail.com>
Date: Thu, 17 Jan 2019 15:04:35 +0100
Subject: [PATCH] fixed misuse of realloc

if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
---
 ccid/src/ccid.c                                   | 12 +++++++-----
 pcsc-relay/src/opicc.c                            | 12 +++++++-----
 virtualsmartcard/src/vpcd/vpcd.c                  | 12 +++++++-----
 virtualsmartcard/win32/BixVReader/PipeReader.cpp  | 12 +++++++-----
 virtualsmartcard/win32/BixVReader/TcpIpReader.cpp | 14 ++++++++------
 virtualsmartcard/win32/BixVReader/memory.cpp      | 14 ++++++++------
 6 files changed, 44 insertions(+), 32 deletions(-)

diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c
index 40d1a37..604441a 100644
--- a/ccid/src/ccid.c
+++ b/ccid/src/ccid.c
@@ -229,12 +229,14 @@ static int get_rapdu(sc_apdu_t *apdu, __u8 **buf, size_t *resplen)
     }
 
     apdu->resplen = apdu->le;
-    apdu->resp = realloc(*buf, apdu->resplen);
-    if (!apdu->resp) {
-        sc_result = SC_ERROR_OUT_OF_MEMORY;
-        goto err;
+    if (0 != apdu->resplen) {
+        apdu->resp = realloc(*buf, apdu->resplen);
+        if (!apdu->resp) {
+            sc_result = SC_ERROR_OUT_OF_MEMORY;
+            goto err;
+        }
+        *buf = apdu->resp;
     }
-    *buf = apdu->resp;
 
     if (apdu->cla == 0xff) {
         sc_result = perform_pseudo_apdu(card->reader, apdu);
diff --git a/pcsc-relay/src/opicc.c b/pcsc-relay/src/opicc.c
index 53edf40..d67f4ac 100644
--- a/pcsc-relay/src/opicc.c
+++ b/pcsc-relay/src/opicc.c
@@ -102,12 +102,14 @@ int picc_decode_apdu(const char *inbuf, size_t inlen,
     }
     end++;
 
-    p = realloc(*outbuf, length);
-    if (!p) {
-        RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
-        return 0;
+    if (length != 0) {
+        p = realloc(*outbuf, length);
+        if (!p) {
+            RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
+            return 0;
+        }
+        *outbuf = p;
     }
-    *outbuf = p;
 
     pos = 0;
     while(inbuf+inlen > end && length > pos) {
diff --git a/virtualsmartcard/src/vpcd/vpcd.c b/virtualsmartcard/src/vpcd/vpcd.c
index e430f1b..ef7bb85 100644
--- a/virtualsmartcard/src/vpcd/vpcd.c
+++ b/virtualsmartcard/src/vpcd/vpcd.c
@@ -240,12 +240,14 @@ static ssize_t recvFromVICC(struct vicc_ctx *ctx, unsigned char **buffer)
 
     size = ntohs(size);
 
-    p = realloc(*buffer, size);
-    if (p == NULL) {
-        errno = ENOMEM;
-        return -1;
+    if (0 != size) {
+        p = realloc(*buffer, size);
+        if (p == NULL) {
+            errno = ENOMEM;
+            return -1;
+        }
+        *buffer = p;
     }
-    *buffer = p;
 
     /* receive message */
     return recvall(ctx->client_sock, *buffer, size);
diff --git a/virtualsmartcard/win32/BixVReader/PipeReader.cpp b/virtualsmartcard/win32/BixVReader/PipeReader.cpp
index 6060709..e87a82b 100644
--- a/virtualsmartcard/win32/BixVReader/PipeReader.cpp
+++ b/virtualsmartcard/win32/BixVReader/PipeReader.cpp
@@ -93,12 +93,14 @@ bool PipeReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
 		pipe=NULL;
 		return false;
 	}
-	BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
-	if (p==NULL) {
-		pipe=NULL;
-		return false;
+	if (0 != dwRespLen) {
+		BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
+		if (p==NULL) {
+			pipe=NULL;
+			return false;
+		}
+		*Resp=p;
 	}
-	*Resp=p;
 	if (!ReadFile(pipe,*Resp,dwRespLen,&read,NULL)) {
 		pipe=NULL;
 		return false;
diff --git a/virtualsmartcard/win32/BixVReader/TcpIpReader.cpp b/virtualsmartcard/win32/BixVReader/TcpIpReader.cpp
index a611926..6b698d7 100644
--- a/virtualsmartcard/win32/BixVReader/TcpIpReader.cpp
+++ b/virtualsmartcard/win32/BixVReader/TcpIpReader.cpp
@@ -71,13 +71,15 @@ bool TcpIpReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
 		AcceptSocket=NULL;
 		return false;
 	}
-	BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
-	if (p==NULL) {
-		::shutdown(AcceptSocket,SD_BOTH);
-		AcceptSocket=NULL;
-		return false;
+	if (0 != dwRespLen) {
+		BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
+		if (p==NULL) {
+			::shutdown(AcceptSocket,SD_BOTH);
+			AcceptSocket=NULL;
+			return false;
+		}
+		*Resp=p;
 	}
-	*Resp=p;
 	if ((read=recv(AcceptSocket,(char*)*Resp,dwRespLen,MSG_WAITALL))<=0) {
 		::shutdown(AcceptSocket,SD_BOTH);
 		AcceptSocket=NULL;
diff --git a/virtualsmartcard/win32/BixVReader/memory.cpp b/virtualsmartcard/win32/BixVReader/memory.cpp
index 656f381..be08da3 100644
--- a/virtualsmartcard/win32/BixVReader/memory.cpp
+++ b/virtualsmartcard/win32/BixVReader/memory.cpp
@@ -11,14 +11,16 @@ bool getBuffer(IWDFIoRequest* pRequest,void **buffer,int *bufferLen) {
 	else {
 		SIZE_T size;
 		void *data=inmem->GetDataBuffer(&size);
-		void *out = realloc(*buffer, size);
-		if (out==NULL) {
-			OutputDebugString(L"realloc failed");
-			return false;
+		if (0 != size) {
+			void *out = realloc(*buffer, size);
+			if (out==NULL) {
+				OutputDebugString(L"realloc failed");
+				return false;
+			}
+			memcpy(out,data,size);
+			(*buffer)=out;
 		}
-		memcpy(out,data,size);
 		(*bufferLen)=(int)size;
-		(*buffer)=out;
 		inmem->Release();
 		return true;
 	}