VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixed misuse of realloc

Browse Source 
if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
virtualsmartcard/win32/BixVReader/PipeReader.cpp
View File

@@ -93,12 +93,14 @@ bool PipeReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
pipe=NULL;
return false;
}
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
if (p==NULL) {
pipe=NULL;
return false;
if (0 != dwRespLen) {
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
if (p==NULL) {
pipe=NULL;
return false;
}
*Resp=p;
}
*Resp=p;
if (!ReadFile(pipe,*Resp,dwRespLen,&read,NULL)) {
pipe=NULL;
return false;

14
virtualsmartcard/win32/BixVReader/TcpIpReader.cpp
View File

@@ -71,13 +71,15 @@ bool TcpIpReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
AcceptSocket=NULL;
return false;
}
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
if (p==NULL) {
::shutdown(AcceptSocket,SD_BOTH);
AcceptSocket=NULL;
return false;
if (0 != dwRespLen) {
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
if (p==NULL) {
::shutdown(AcceptSocket,SD_BOTH);
AcceptSocket=NULL;
return false;
}
*Resp=p;
}
*Resp=p;
if ((read=recv(AcceptSocket,(char*)*Resp,dwRespLen,MSG_WAITALL))<=0) {
::shutdown(AcceptSocket,SD_BOTH);
AcceptSocket=NULL;

14
virtualsmartcard/win32/BixVReader/memory.cpp
View File

@@ -11,14 +11,16 @@ bool getBuffer(IWDFIoRequest* pRequest,void **buffer,int *bufferLen) {
else {
SIZE_T size;
void *data=inmem->GetDataBuffer(&size);
void *out = realloc(*buffer, size);
if (out==NULL) {
OutputDebugString(L"realloc failed");
return false;
if (0 != size) {
void *out = realloc(*buffer, size);
if (out==NULL) {
OutputDebugString(L"realloc failed");
return false;
}
memcpy(out,data,size);
(*buffer)=out;
}
memcpy(out,data,size);
(*bufferLen)=(int)size;
(*buffer)=out;
inmem->Release();
return true;
}