Skip to content

Commit 17d8980

Browse files
Jakujefrankmorgner
authored andcommitted
oberthur: Avoid two buffer overflows
Thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112
1 parent 9c91a43 commit 17d8980

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

Diff for: src/libopensc/pkcs15-oberthur.c

+6-2
Original file line numberDiff line numberDiff line change
@@ -884,12 +884,16 @@ sc_pkcs15emu_oberthur_add_data(struct sc_pkcs15_card *p15card,
884884
offs = 2;
885885

886886
/* Label */
887-
if (offs > info_len) {
887+
if (offs + 2 > info_len) {
888888
free(info_blob);
889889
LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add data: no 'label'");
890890
}
891891
label = info_blob + offs + 2;
892892
label_len = *(info_blob + offs + 1) + *(info_blob + offs) * 0x100;
893+
if (offs + 2 + label_len > info_len) {
894+
free(info_blob);
895+
LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Invalid length of 'label' received");
896+
}
893897
if (label_len > sizeof(dobj.label) - 1)
894898
label_len = sizeof(dobj.label) - 1;
895899
offs += 2 + *(info_blob + offs + 1);
@@ -906,7 +910,7 @@ sc_pkcs15emu_oberthur_add_data(struct sc_pkcs15_card *p15card,
906910
offs += 2 + app_len;
907911

908912
/* OID encode like DER(ASN.1(oid)) */
909-
if (offs > info_len) {
913+
if (offs + 1 > info_len) {
910914
free(info_blob);
911915
LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add data: no 'OID'");
912916
}

0 commit comments

Comments
 (0)