Skip to content

Commit f015746

Browse files
committed
idprime: Use temporary variable instead of messing up the passed one
Thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
1 parent 78cdab9 commit f015746

File tree

1 file changed

+9
-6
lines changed

1 file changed

+9
-6
lines changed

Diff for: src/libopensc/card-idprime.c

+9-6
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
418418
sc_path_t tinfo_path = {"\x00\x00", 2, 0, 0, SC_PATH_TYPE_PATH, {"", 0}};
419419
sc_file_t *file = NULL;
420420
u8 buf[2];
421+
char *name;
421422
int r;
422423

423424
LOG_FUNC_CALLED(card->ctx);
@@ -445,20 +446,22 @@ static int idprime_get_token_name(sc_card_t* card, char** tname)
445446
}
446447
sc_file_free(file);
447448

448-
*tname = malloc(buf[1]);
449-
if (*tname == NULL) {
449+
name = malloc(buf[1]);
450+
if (name == NULL) {
450451
LOG_FUNC_RETURN(card->ctx, SC_ERROR_OUT_OF_MEMORY);
451452
}
452453

453-
r = iso_ops->read_binary(card, 2, (unsigned char *)*tname, buf[1], 0);
454+
r = iso_ops->read_binary(card, 2, (unsigned char *)name, buf[1], 0);
454455
if (r < 1) {
455-
free(*tname);
456+
free(name);
456457
LOG_FUNC_RETURN(card->ctx, r);
457458
}
458459

459-
if ((*tname)[r-1] != '\0') {
460-
(*tname)[r-1] = '\0';
460+
if (name[r-1] != '\0') {
461+
name[r-1] = '\0';
461462
}
463+
*tname = name;
464+
462465
LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);
463466
}
464467

0 commit comments

Comments
 (0)