fixed misuse of realloc

if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.

ccid/src/ccid.c

@@ -229,12 +229,14 @@ static int get_rapdu(sc_apdu_t *apdu, __u8 **buf, size_t *resplen)
     }
 
     apdu->resplen = apdu->le;
-    apdu->resp = realloc(*buf, apdu->resplen);
-    if (!apdu->resp) {
-        sc_result = SC_ERROR_OUT_OF_MEMORY;
-        goto err;
+    if (0 != apdu->resplen) {
+        apdu->resp = realloc(*buf, apdu->resplen);
+        if (!apdu->resp) {
+            sc_result = SC_ERROR_OUT_OF_MEMORY;
+            goto err;
+        }
+        *buf = apdu->resp;
     }
-    *buf = apdu->resp;
 
     if (apdu->cla == 0xff) {
         sc_result = perform_pseudo_apdu(card->reader, apdu);

pcsc-relay/src/opicc.c

@@ -102,12 +102,14 @@ int picc_decode_apdu(const char *inbuf, size_t inlen,
     }
     end++;
 
-    p = realloc(*outbuf, length);
-    if (!p) {
-        RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
-        return 0;
+    if (length != 0) {
+        p = realloc(*outbuf, length);
+        if (!p) {
+            RELAY_ERROR("Error allocating memory for decoded C-APDU\n");
+            return 0;
+        }
+        *outbuf = p;
     }
-    *outbuf = p;
 
     pos = 0;
     while(inbuf+inlen > end && length > pos) {

virtualsmartcard/src/vpcd/vpcd.c

@@ -240,12 +240,14 @@ static ssize_t recvFromVICC(struct vicc_ctx *ctx, unsigned char **buffer)
 
     size = ntohs(size);
 
-    p = realloc(*buffer, size);
-    if (p == NULL) {
-        errno = ENOMEM;
-        return -1;
+    if (0 != size) {
+        p = realloc(*buffer, size);
+        if (p == NULL) {
+            errno = ENOMEM;
+            return -1;
+        }
+        *buffer = p;
     }
-    *buffer = p;
 
     /* receive message */
     return recvall(ctx->client_sock, *buffer, size);

virtualsmartcard/win32/BixVReader/PipeReader.cpp

@@ -93,12 +93,14 @@ bool PipeReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
 		pipe=NULL;
 		return false;
 	}
-	BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
-	if (p==NULL) {
-		pipe=NULL;
-		return false;
+	if (0 != dwRespLen) {
+		BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
+		if (p==NULL) {
+			pipe=NULL;
+			return false;
+		}
+		*Resp=p;
 	}
-	*Resp=p;
 	if (!ReadFile(pipe,*Resp,dwRespLen,&read,NULL)) {
 		pipe=NULL;
 		return false;

virtualsmartcard/win32/BixVReader/TcpIpReader.cpp

@@ -71,13 +71,15 @@ bool TcpIpReader::QueryTransmit(BYTE *APDU,int APDUlen,BYTE **Resp,int *Resplen)
 		AcceptSocket=NULL;
 		return false;
 	}
-	BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
-	if (p==NULL) {
-		::shutdown(AcceptSocket,SD_BOTH);
-		AcceptSocket=NULL;
-		return false;
+	if (0 != dwRespLen) {
+		BYTE *p=(BYTE *)realloc(*Resp, dwRespLen);
+		if (p==NULL) {
+			::shutdown(AcceptSocket,SD_BOTH);
+			AcceptSocket=NULL;
+			return false;
+		}
+		*Resp=p;
 	}
-	*Resp=p;
 	if ((read=recv(AcceptSocket,(char*)*Resp,dwRespLen,MSG_WAITALL))<=0) {
 		::shutdown(AcceptSocket,SD_BOTH);
 		AcceptSocket=NULL;

virtualsmartcard/win32/BixVReader/memory.cpp

@@ -11,14 +11,16 @@ bool getBuffer(IWDFIoRequest* pRequest,void **buffer,int *bufferLen) {
 	else {
 		SIZE_T size;
 		void *data=inmem->GetDataBuffer(&size);
-		void *out = realloc(*buffer, size);
-		if (out==NULL) {
-			OutputDebugString(L"realloc failed");
-			return false;
+		if (0 != size) {
+			void *out = realloc(*buffer, size);
+			if (out==NULL) {
+				OutputDebugString(L"realloc failed");
+				return false;
+			}
+			memcpy(out,data,size);
+			(*buffer)=out;
 		}
-		memcpy(out,data,size);
 		(*bufferLen)=(int)size;
-		(*buffer)=out;
 		inmem->Release();
 		return true;
 	}