Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handle too large PC/SC buffer values #5

Merged
merged 1 commit into from Dec 31, 2015
Merged

Handle too large PC/SC buffer values #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 11 additions & 2 deletions src/pcsc/pcsc.c
View file
Open in desktop
Expand Up @@ -25,6 +25,7 @@
#ifdef DEBUG_IFDH
#include <syslog.h>
#endif
#include <limits.h>
#ifdef __APPLE__
#include <PCSC/wintypes.h>
#include <PCSC/pcsclite.h>
Expand Down Expand Up @@ -390,6 +391,10 @@ IFDHTransmitToICC(DWORD Lun, SCARD_IO_HEADER SendPci,
ctn = ((unsigned short)(Lun >> 16)) % IFDH_MAX_READERS;
slot = ((unsigned short)(Lun & 0x0000FFFF)) % IFDH_MAX_SLOTS;

if (TxLength > USHRT_MAX) {
(*RxLength) = 0;
return IFD_PROTOCOL_NOT_SUPPORTED;
}
#ifdef HAVE_PTHREAD
pthread_mutex_lock(&ifdh_context_mutex[ctn]);
#endif
Expand All @@ -399,7 +404,7 @@ IFDHTransmitToICC(DWORD Lun, SCARD_IO_HEADER SendPci,
#endif
dad = (UCHAR) ((slot == 0) ? 0x00 : slot + 1);
sad = 0x02;
lr = (unsigned short)(*RxLength);
lr = (*RxLength > USHRT_MAX) ? USHRT_MAX : (unsigned short)(*RxLength);
lc = (unsigned short)TxLength;

ret = CT_data(ctn, &dad, &sad, lc, TxBuffer, &lr, RxBuffer);
Expand Down Expand Up @@ -438,6 +443,10 @@ IFDHControl(DWORD Lun, PUCHAR TxBuffer,
ctn = ((unsigned short)(Lun >> 16)) % IFDH_MAX_READERS;
slot = ((unsigned short)(Lun & 0x0000FFFF)) % IFDH_MAX_SLOTS;

if (TxLength > USHRT_MAX) {
(*RxLength) = 0;
return IFD_PROTOCOL_NOT_SUPPORTED;
}
#ifdef HAVE_PTHREAD
pthread_mutex_lock(&ifdh_context_mutex[ctn]);
#endif
Expand All @@ -447,7 +456,7 @@ IFDHControl(DWORD Lun, PUCHAR TxBuffer,
#endif
dad = 0x01;
sad = 0x02;
lr = (unsigned short)(*RxLength);
lr = (*RxLength > USHRT_MAX) ? USHRT_MAX : (unsigned short)(*RxLength);
lc = (unsigned short)TxLength;

ret = CT_data(ctn, &dad, &sad, lc, TxBuffer, &lr, RxBuffer);
Expand Down