73 lines
2.4 KiB
Diff
73 lines
2.4 KiB
Diff
|
commit a1bcc6516f43d570899820d259b71c53f8049168
|
||
|
|
Author: Veronika Hanulíková <vhanulik@redhat.com>
|
||
|
|
Date: Thu Jul 18 09:23:20 2024 +0200
|
||
|
|
|
||
|
|
pkcs15-starcos: Check length of file to be non-zero
|
||
|
|
|
||
|
|
Thanks Matteo Marini for report
|
||
|
|
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-p3mx-7472-h3j8
|
||
|
|
|
||
|
|
fuzz_pkcs15init/20
|
||
|
|
|
||
|
|
Index: opensc-0.24.0/src/pkcs15init/pkcs15-starcos.c
|
||
|
|
===================================================================
|
||
|
|
--- opensc-0.24.0.orig/src/pkcs15init/pkcs15-starcos.c
|
||
|
|
+++ opensc-0.24.0/src/pkcs15init/pkcs15-starcos.c
|
||
|
|
@@ -670,6 +670,8 @@ static int starcos_write_pukey(sc_profil
|
||
|
|
return r;
|
||
|
|
len = tfile->size;
|
||
|
|
sc_file_free(tfile);
|
||
|
|
+ if (len == 0)
|
||
|
|
+ return SC_ERROR_INTERNAL;
|
||
|
|
buf = malloc(len);
|
||
|
|
if (!buf)
|
||
|
|
return SC_ERROR_OUT_OF_MEMORY;
|
||
|
|
@@ -684,7 +686,7 @@ static int starcos_write_pukey(sc_profil
|
||
|
|
if (num_keys == 0xff)
|
||
|
|
num_keys = 0;
|
||
|
|
/* encode public key */
|
||
|
|
- keylen = starcos_encode_pukey(rsa, NULL, kinfo);
|
||
|
|
+ keylen = starcos_encode_pukey(rsa, NULL, kinfo);
|
||
|
|
if (!keylen) {
|
||
|
|
free(buf);
|
||
|
|
return SC_ERROR_INTERNAL;
|
||
|
|
Index: opensc-0.24.0/src/libopensc/iasecc-sdo.c
|
||
|
|
===================================================================
|
||
|
|
--- opensc-0.24.0.orig/src/libopensc/iasecc-sdo.c
|
||
|
|
+++ opensc-0.24.0/src/libopensc/iasecc-sdo.c
|
||
|
|
@@ -317,16 +317,25 @@ iasecc_se_parse(struct sc_card *card, un
|
||
|
|
|
||
|
|
LOG_FUNC_CALLED(ctx);
|
||
|
|
|
||
|
|
+ if (data_len < 1)
|
||
|
|
+ LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
|
||
|
|
+
|
||
|
|
if (*data == IASECC_SDO_TEMPLATE_TAG) {
|
||
|
|
size_size = iasecc_parse_size(data + 1, data_len - 1, &size);
|
||
|
|
LOG_TEST_RET(ctx, size_size, "parse error: invalid size data of IASECC_SDO_TEMPLATE");
|
||
|
|
|
||
|
|
+ if (data_len - 1 < size)
|
||
|
|
+ LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
|
||
|
|
+
|
||
|
|
data += size_size + 1;
|
||
|
|
data_len = size;
|
||
|
|
sc_log(ctx,
|
||
|
|
"IASECC_SDO_TEMPLATE: size %"SC_FORMAT_LEN_SIZE_T"u, size_size %"SC_FORMAT_LEN_SIZE_T"u",
|
||
|
|
size, size_size);
|
||
|
|
|
||
|
|
+ if (data_len < 3)
|
||
|
|
+ LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
|
||
|
|
+
|
||
|
|
if (*data != IASECC_SDO_TAG_HEADER)
|
||
|
|
LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
|
||
|
|
|
||
|
|
@@ -757,6 +766,8 @@ iasecc_sdo_parse(struct sc_card *card, u
|
||
|
|
int rv;
|
||
|
|
|
||
|
|
LOG_FUNC_CALLED(ctx);
|
||
|
|
+ if (data == NULL || data_len < 2)
|
||
|
|
+ LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
|
||
|
|
|
||
|
|
if (*data == IASECC_SDO_TEMPLATE_TAG) {
|
||
|
|
size_size = iasecc_parse_size(data + 1, data_len - 1, &size);
|