File opensc-oberthur-overflow2.patch of Package opensc.33796

Overview Repositories Revisions Requests Users Attributes Meta

File opensc-oberthur-overflow2.patch of Package opensc.33796

From 05648b0604bf3e498e8d42dff3c6e7c56a5bf749 Mon Sep 17 00:00:00 2001
From: Frank Morgner <frankmorgner@gmail.com>
Date: Wed, 17 Mar 2021 18:16:34 +0100
Subject: [PATCH 3/5] oberthur: fixed Heap-buffer-overflow

fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32149
---
 src/libopensc/pkcs15-oberthur.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Index: opensc-0.13.0/src/libopensc/pkcs15-oberthur.c
===================================================================
--- opensc-0.13.0.orig/src/libopensc/pkcs15-oberthur.c
+++ opensc-0.13.0/src/libopensc/pkcs15-oberthur.c
@@ -596,10 +596,12 @@ sc_pkcs15emu_oberthur_add_pubkey(struct
 	offs += 2 + len;
 	
 	/* ID */
-	if (offs > info_len) 
+	if (offs + 2 > info_len) 
 		SC_TEST_RET(ctx, SC_LOG_DEBUG_NORMAL, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add public key: no 'ID'");
 	len = *(info_blob + offs + 1) + *(info_blob + offs) * 0x100;
-	if (!len || len > sizeof(key_info.id.value))
+	if (len == 0
+			|| len > sizeof(key_info.id.value)
+			|| offs + 2 + len > info_len)
 		SC_TEST_RET(ctx, SC_LOG_DEBUG_NORMAL, SC_ERROR_INVALID_DATA, "Failed to add public key: invalie 'ID' length");
 	memcpy(key_info.id.value, info_blob + offs + 2, len);
 	key_info.id.len = len;

Places

File opensc-oberthur-overflow2.patch of Package opensc.33796

Places