VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixed misuse of realloc

Browse Source 
if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ccid/src/ccid.c
View File

@@ -229,12 +229,14 @@ static int get_rapdu(sc_apdu_t *apdu, __u8 **buf, size_t *resplen)
} }
apdu->resplen = apdu->le; apdu->resplen = apdu->le;
apdu->resp = realloc(*buf, apdu->resplen); if (0 != apdu->resplen) {
if (!apdu->resp) { apdu->resp = realloc(*buf, apdu->resplen);
sc_result = SC_ERROR_OUT_OF_MEMORY; if (!apdu->resp) {
goto err; sc_result = SC_ERROR_OUT_OF_MEMORY;
goto err;
}
*buf = apdu->resp;
} }
*buf = apdu->resp;
if (apdu->cla == 0xff) { if (apdu->cla == 0xff) {
sc_result = perform_pseudo_apdu(card->reader, apdu); sc_result = perform_pseudo_apdu(card->reader, apdu);

12
pcsc-relay/src/opicc.c
View File

@@ -102,12 +102,14 @@ int picc_decode_apdu(const char *inbuf, size_t inlen,
} }
end++; end++;
p = realloc(*outbuf, length); if (length != 0) {
if (!p) { p = realloc(*outbuf, length);
RELAY_ERROR("Error allocating memory for decoded C-APDU\n"); if (!p) {
return 0; RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
return 0;
}
*outbuf = p;
} }
*outbuf = p;
pos = 0; pos = 0;
while(inbuf+inlen > end && length > pos) { while(inbuf+inlen > end && length > pos) {

12
virtualsmartcard/src/vpcd/vpcd.c
View File

@@ -240,12 +240,14 @@ static ssize_t recvFromVICC(struct vicc_ctx *ctx, unsigned char **buffer)
size = ntohs(size); size = ntohs(size);
p = realloc(*buffer, size); if (0 != size) {
if (p == NULL) { p = realloc(*buffer, size);
errno = ENOMEM; if (p == NULL) {
return -1; errno = ENOMEM;
return -1;
}
*buffer = p;
} }
*buffer = p;
/* receive message */ /* receive message */
return recvall(ctx->client_sock, *buffer, size); return recvall(ctx->client_sock, *buffer, size);

12
virtualsmartcard/win32/BixVReader/PipeReader.cpp
View File

@@ -93,12 +93,14 @@ bool PipeReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
pipe=NULL; pipe=NULL;
return false; return false;
} }
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen); if (0 != dwRespLen) {
if (p==NULL) { BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
pipe=NULL; if (p==NULL) {
return false; pipe=NULL;
return false;
}
*Resp=p;
} }
*Resp=p;
if (!ReadFile(pipe,*Resp,dwRespLen,&read,NULL)) { if (!ReadFile(pipe,*Resp,dwRespLen,&read,NULL)) {
pipe=NULL; pipe=NULL;
return false; return false;

14
virtualsmartcard/win32/BixVReader/TcpIpReader.cpp
View File

@@ -71,13 +71,15 @@ bool TcpIpReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
AcceptSocket=NULL; AcceptSocket=NULL;
return false; return false;
} }
BYTE *p=(BYTE *)realloc(*Resp, dwRespLen); if (0 != dwRespLen) {
if (p==NULL) { BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
::shutdown(AcceptSocket,SD_BOTH); if (p==NULL) {
AcceptSocket=NULL; ::shutdown(AcceptSocket,SD_BOTH);
return false; AcceptSocket=NULL;
return false;
}
*Resp=p;
} }
*Resp=p;
if ((read=recv(AcceptSocket,(char*)*Resp,dwRespLen,MSG_WAITALL))<=0) { if ((read=recv(AcceptSocket,(char*)*Resp,dwRespLen,MSG_WAITALL))<=0) {
::shutdown(AcceptSocket,SD_BOTH); ::shutdown(AcceptSocket,SD_BOTH);
AcceptSocket=NULL; AcceptSocket=NULL;

14
virtualsmartcard/win32/BixVReader/memory.cpp
View File

@@ -11,14 +11,16 @@ bool getBuffer(IWDFIoRequest* pRequest,void **buffer,int *bufferLen) {
else { else {
SIZE_T size; SIZE_T size;
void *data=inmem->GetDataBuffer(&size); void *data=inmem->GetDataBuffer(&size);
void *out = realloc(*buffer, size); if (0 != size) {
if (out==NULL) { void *out = realloc(*buffer, size);
OutputDebugString(L"realloc failed"); if (out==NULL) {
return false; OutputDebugString(L"realloc failed");
return false;
}
memcpy(out,data,size);
(*buffer)=out;
} }
memcpy(out,data,size);
(*bufferLen)=(int)size; (*bufferLen)=(int)size;
(*buffer)=out;
inmem->Release(); inmem->Release();
return true; return true;
} }