-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
USB serial number parsing has problems with leading zeros #89
Comments
The code in https://github.com/Yubico/yubihsm-shell/blob/master/lib/lib_util.c#L156 uses Simple solution is to just change the last argument in this instance to 10, i.e.:
..which leads to the behavior you expected:
I do not have a strong opinion here as it does not have any clear security implications but it feels natural that it should be documented and be reflected in the unit test ( |
Note: that this might break existing scripts since this changes behaviour. Note 2: there are other strtoul() in this file still parsing with the old behaviour, i.e. allowing 0x and 0 prefix for hex and octal. Fixes issue #89
@nevun: as you mention in the linked commit, it is theoretically possible that some scripts or other usage of the CLI tool are based on the hex/octal behaviour. I assume it is a rarely used edge case and wasn't documented as such. |
I'm OK with the change, but I think that at that point it's worth returning false from that function, at least in the I believe the behavior now is quite surprising in that instance: as shown in the test if a serial number of The octal case is a bit trickier since a leading zero doesn't make |
I recently noticed that leading zeros in the device serial number throw off the command line parsing when specifying
-C "yhusb://serial=
to connect to a particular local device.Good behaviour:
Unexpected behaviour:
1131796 is not a reasonable serial number in this context.
This is relevant for people that use the serial number as delivered by
lsusb -v
, example output:The text was updated successfully, but these errors were encountered: