mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-27 07:57:27 +00:00
Ankur Tyagi
9a19b0f3cb
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66215 Backport the patches referenced by the PR[1] mentioned in the nvd. Dropped the formatting commit from the backport. [1] https://github.com/OpenSC/OpenSC/pull/3436 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 5f8c904577cce1a6e21f793ba4aab1c473ff4136 Mon Sep 17 00:00:00 2001
|
|
From: Frank Morgner <frankmorgner@gmail.com>
|
|
Date: Wed, 4 Jun 2025 01:07:56 +0200
|
|
Subject: [PATCH] oberthur: fixed potential Stack-buffer-overflow WRITE
|
|
|
|
(cherry picked from commit 3402a90d8c9be223d4cf6abe009a4707117d7972)
|
|
|
|
CVE: CVE-2025-66215
|
|
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/3402a90d8c9be223d4cf6abe009a4707117d7972]
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
src/libopensc/card-oberthur.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/libopensc/card-oberthur.c b/src/libopensc/card-oberthur.c
|
|
index a8aba7992..216640ebd 100644
|
|
--- a/src/libopensc/card-oberthur.c
|
|
+++ b/src/libopensc/card-oberthur.c
|
|
@@ -2246,14 +2246,16 @@ auth_read_record(struct sc_card *card, unsigned int nr_rec, unsigned int idx,
|
|
if (flags & SC_RECORD_BY_REC_NR)
|
|
apdu.p2 |= 0x04;
|
|
|
|
- apdu.le = count;
|
|
- apdu.resplen = count;
|
|
+ apdu.le = count > SC_MAX_APDU_BUFFER_SIZE ? SC_MAX_APDU_BUFFER_SIZE : count;
|
|
+ apdu.resplen = SC_MAX_APDU_BUFFER_SIZE;
|
|
apdu.resp = recvbuf;
|
|
|
|
rv = sc_transmit_apdu(card, &apdu);
|
|
LOG_TEST_RET(card->ctx, rv, "APDU transmit failed");
|
|
if (apdu.resplen == 0)
|
|
LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2));
|
|
+ if (count < apdu.resplen)
|
|
+ LOG_FUNC_RETURN(card->ctx, SC_ERROR_WRONG_LENGTH);
|
|
memcpy(buf, recvbuf, apdu.resplen);
|
|
|
|
rv = sc_check_sw(card, apdu.sw1, apdu.sw2);
|