jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

PCSC: Make AID copying easier for static analyzers

Browse source 
Use a separate pointer and length field instead of trying to copy from a
struct field that has only part of the full buffer available.
(CID 68115)

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-12-05 23:18:56 +02:00
parent c397eff828
commit f27f1644a8
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
src/utils/pcsc_funcs.c
View file

@ -402,10 +402,12 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
unsigned char rid[5];
unsigned char appl_code[2]; /* 0x1002 for 3G USIM */
} *efdir;
unsigned char buf[127];
unsigned char buf[127], *aid_pos;
size_t blen;
unsigned int aid_len = 0;
efdir = (struct efdir *) buf;
aid_pos = &buf[4];
blen = sizeof(buf);
if (scard_select_file(scard, SCARD_FILE_EF_DIR, buf, &blen)) {
wpa_printf(MSG_DEBUG, "SCARD: Failed to read EF_DIR");
@ -454,14 +456,15 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
continue;
}
if (efdir->aid_len < 1 || efdir->aid_len > 16) {
wpa_printf(MSG_DEBUG, "SCARD: Invalid AID length %d",
efdir->aid_len);
aid_len = efdir->aid_len;
if (aid_len < 1 || aid_len > 16) {
wpa_printf(MSG_DEBUG, "SCARD: Invalid AID length %u",
aid_len);
continue;
}
wpa_hexdump(MSG_DEBUG, "SCARD: AID from EF_DIR record",
efdir->rid, efdir->aid_len);
aid_pos, aid_len);
if (efdir->appl_code[0] == 0x10 &&
efdir->appl_code[1] == 0x02) {
@ -477,14 +480,14 @@ static int scard_get_aid(struct scard_data *scard, unsigned char *aid,
return -1;
}
if (efdir->aid_len > maxlen) {
if (aid_len > maxlen) {
wpa_printf(MSG_DEBUG, "SCARD: Too long AID");
return -1;
}
os_memcpy(aid, efdir->rid, efdir->aid_len);
os_memcpy(aid, aid_pos, aid_len);
return efdir->aid_len;
return aid_len;
}