VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixed misuse of realloc

Browse Source 
if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ccid/src/ccid.c
View File

@@ -229,12 +229,14 @@ static int get_rapdu(sc_apdu_t *apdu, __u8 **buf, size_t *resplen)
}
apdu->resplen = apdu->le;
apdu->resp = realloc(*buf, apdu->resplen);
if (!apdu->resp) {
sc_result = SC_ERROR_OUT_OF_MEMORY;
goto err;
if (0 != apdu->resplen) {
apdu->resp = realloc(*buf, apdu->resplen);
if (!apdu->resp) {
sc_result = SC_ERROR_OUT_OF_MEMORY;
goto err;
}
*buf = apdu->resp;
}
*buf = apdu->resp;
if (apdu->cla == 0xff) {
sc_result = perform_pseudo_apdu(card->reader, apdu);