From feebfe7a74b225c0ee12824475f77311eff0abc7 Mon Sep 17 00:00:00 2001
From: Frank Morgner <morgner@informatik.hu-berlin.de>
Date: Sun, 25 Jan 2015 03:53:52 +0100
Subject: [PATCH] fixed potentially dereferencing null pointer

---
 npa/src/boxing.c                         |  7 ++++---
 npa/src/card-npa.c                       |  2 +-
 npa/src/npa.c                            | 10 ++++++++--
 virtualsmartcard/src/ifd-vpcd/ifd-vpcd.c |  2 +-
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/npa/src/boxing.c b/npa/src/boxing.c
index c38e658..c0c1c81 100644
--- a/npa/src/boxing.c
+++ b/npa/src/boxing.c
@@ -588,7 +588,7 @@ static int boxing_pin_cmd_to_buf(sc_context_t *ctx,
 
 err:
     free(pinapdu);
-    if (r < 0 && *pc_to_rdr_secure) {
+    if (r < 0 && pc_to_rdr_secure && *pc_to_rdr_secure) {
         free(*pc_to_rdr_secure);
         *pc_to_rdr_secure = NULL;
     }
@@ -925,8 +925,9 @@ void sc_detect_boxing_cmds(sc_reader_t *reader)
             || apdu.sw2 != 0x00
             || boxing_buf_to_pace_capabilities(reader->ctx,
                 apdu.resp, apdu.resplen, &capabilities) != SC_SUCCESS) {
-        sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL,
-                "%s does not support boxing commands", reader->name);
+        if (reader)
+            sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL,
+                    "%s does not support boxing commands", reader->name);
     } else {
         if (capabilities & SC_READER_CAP_PIN_PAD
                 && !(reader->capabilities & SC_READER_CAP_PIN_PAD)) {
diff --git a/npa/src/card-npa.c b/npa/src/card-npa.c
index e95ac9a..cfe07c0 100644
--- a/npa/src/card-npa.c
+++ b/npa/src/card-npa.c
@@ -219,7 +219,7 @@ static void npa_cache_or_free(sc_card_t *card,
 {
     struct npa_drv_data *drv_data;
 
-    if (card->drv_data) {
+    if (card && card->drv_data) {
         drv_data = card->drv_data;
 
         if (ef_cardaccess && ef_cardaccess_length
diff --git a/npa/src/npa.c b/npa/src/npa.c
index 6dc4d2f..306eec7 100644
--- a/npa/src/npa.c
+++ b/npa/src/npa.c
@@ -1739,7 +1739,10 @@ err:
     BUF_MEM_clear_free(nonce);
     BUF_MEM_clear_free(signature);
 
-    SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r);
+    if (card)
+        SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r);
+    else
+        return r;
 }
 
 static int npa_mse_set_at_ca(sc_card_t *card, int protocol)
@@ -1931,7 +1934,10 @@ err:
     BUF_MEM_clear_free(token);
     BUF_MEM_clear_free(eph_pub_key);
 
-    SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r);
+    if (card)
+        SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r);
+    else
+        return r;
 }
 
 static const char *MRZ_name = "MRZ";
diff --git a/virtualsmartcard/src/ifd-vpcd/ifd-vpcd.c b/virtualsmartcard/src/ifd-vpcd/ifd-vpcd.c
index 9641bce..b76a52c 100644
--- a/virtualsmartcard/src/ifd-vpcd/ifd-vpcd.c
+++ b/virtualsmartcard/src/ifd-vpcd/ifd-vpcd.c
@@ -295,7 +295,7 @@ IFDHTransmitToICC (DWORD Lun, SCARD_IO_HEADER SendPci, PUCHAR TxBuffer,
     r = IFD_SUCCESS;
 
 err:
-    if (r != IFD_SUCCESS)
+    if (r != IFD_SUCCESS && RxLength)
         *RxLength = 0;
 
     free(rapdu);