47 lines
1.5 KiB
Diff
47 lines
1.5 KiB
Diff
From 17d8980cde7be597afc366b7e311d0d7cadcb1f4 Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Wed, 3 Feb 2021 21:46:15 +0100
|
|
Subject: [PATCH] oberthur: Avoid two buffer overflows
|
|
|
|
Thanks oss-fuzz
|
|
|
|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112
|
|
---
|
|
src/libopensc/pkcs15-oberthur.c | 8 ++++++--
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/libopensc/pkcs15-oberthur.c b/src/libopensc/pkcs15-oberthur.c
|
|
index d3236a9..bf88a06 100644
|
|
--- a/src/libopensc/pkcs15-oberthur.c
|
|
+++ b/src/libopensc/pkcs15-oberthur.c
|
|
@@ -884,12 +884,16 @@ sc_pkcs15emu_oberthur_add_data(struct sc_pkcs15_card *p15card,
|
|
offs = 2;
|
|
|
|
/* Label */
|
|
- if (offs > info_len) {
|
|
+ if (offs + 2 > info_len) {
|
|
free(info_blob);
|
|
LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add data: no 'label'");
|
|
}
|
|
label = info_blob + offs + 2;
|
|
label_len = *(info_blob + offs + 1) + *(info_blob + offs) * 0x100;
|
|
+ if (offs + 2 + label_len > info_len) {
|
|
+ free(info_blob);
|
|
+ LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Invalid length of 'label' received");
|
|
+ }
|
|
if (label_len > sizeof(dobj.label) - 1)
|
|
label_len = sizeof(dobj.label) - 1;
|
|
offs += 2 + *(info_blob + offs + 1);
|
|
@@ -906,7 +910,7 @@ sc_pkcs15emu_oberthur_add_data(struct sc_pkcs15_card *p15card,
|
|
offs += 2 + app_len;
|
|
|
|
/* OID encode like DER(ASN.1(oid)) */
|
|
- if (offs > info_len) {
|
|
+ if (offs + 1 > info_len) {
|
|
free(info_blob);
|
|
LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add data: no 'OID'");
|
|
}
|
|
--
|
|
1.8.3.1
|
|
|