tiamak/salvium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #4043

Browse Source 
34de7bc2 device_ledger: fix buffer underflow on bad data from device (moneromooo-monero)
41e9cab4 device: misc cleanup (moneromooo-monero)
3b4dec2d device_ledger: fix potential buffer overflow from bad size calc (moneromooo-monero)
This commit is contained in:
Riccardo Spagni
2018-07-03 15:21:56 +02:00
parent 82c39355ac 34de7bc267
commit d1f102626c
3 changed files with 19 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/device/device_ledger.cpp
+8 -5
View File
@@ -187,14 +187,15 @@ namespace hw {
void device_ledger::logCMD() {
if (apdu_verbose) {
char strbuffer[1024];
sprintf(strbuffer, "%.02x %.02x %.02x %.02x %.02x ",
snprintf(strbuffer, sizeof(strbuffer), "%.02x %.02x %.02x %.02x %.02x ",
this->buffer_send[0],
this->buffer_send[1],
this->buffer_send[2],
this->buffer_send[3],
this->buffer_send[4]
);
buffer_to_str(strbuffer+strlen(strbuffer), sizeof(strbuffer), (char*)(this->buffer_send+5), this->length_send-5);
const size_t len = strlen(strbuffer);
buffer_to_str(strbuffer+len, sizeof(strbuffer)-len, (char*)(this->buffer_send+5), this->length_send-5);
MDEBUG( "CMD :" << strbuffer);
}
}
@@ -202,11 +203,12 @@ namespace hw {
void device_ledger::logRESP() {
if (apdu_verbose) {
char strbuffer[1024];
sprintf(strbuffer, "%.02x%.02x ",
snprintf(strbuffer, sizeof(strbuffer), "%.02x%.02x ",
this->buffer_recv[this->length_recv-2],
this->buffer_recv[this->length_recv-1]
);
buffer_to_str(strbuffer+strlen(strbuffer), sizeof(strbuffer), (char*)(this->buffer_recv), this->length_recv-2);
const size_t len = strlen(strbuffer);
buffer_to_str(strbuffer+len, sizeof(strbuffer)-len, (char*)(this->buffer_recv), this->length_recv-2);
MDEBUG( "RESP :" << strbuffer);
}
@@ -293,7 +295,7 @@ namespace hw {
unsigned int device_ledger::exchange(unsigned int ok, unsigned int mask) {
LONG rv;
int sw;
unsigned int sw;
ASSERT_T0(this->length_send <= BUFFER_SEND_SIZE);
logCMD();
@@ -302,6 +304,7 @@ namespace hw {
SCARD_PCI_T0, this->buffer_send, this->length_send,
NULL, this->buffer_recv, &this->length_recv);
ASSERT_RV(rv);
ASSERT_T0(this->length_recv >= 2);
ASSERT_T0(this->length_recv <= BUFFER_RECV_SIZE);
logRESP();