mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-26 07:37:14 +00:00
Ankur Tyagi
9a19b0f3cb
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66215 Backport the patches referenced by the PR[1] mentioned in the nvd. Dropped the formatting commit from the backport. [1] https://github.com/OpenSC/OpenSC/pull/3436 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
From 4db6d034c9566e903e4c1094beccaf05efc4e7e5 Mon Sep 17 00:00:00 2001
|
|
From: Frank Morgner <frankmorgner@gmail.com>
|
|
Date: Thu, 5 Jun 2025 13:18:15 +0200
|
|
Subject: [PATCH] oberthur: use MIN where possible
|
|
|
|
(cherry picked from commit a4bbf8a631537a4c0083b264095ed1cd36d307ab)
|
|
|
|
CVE: CVE-2025-66215
|
|
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/a4bbf8a631537a4c0083b264095ed1cd36d307ab]
|
|
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
|
|
---
|
|
src/libopensc/card-oberthur.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/libopensc/card-oberthur.c b/src/libopensc/card-oberthur.c
|
|
index 216640ebd..3e7a7b6b9 100644
|
|
--- a/src/libopensc/card-oberthur.c
|
|
+++ b/src/libopensc/card-oberthur.c
|
|
@@ -606,7 +606,7 @@ auth_list_files(struct sc_card *card, unsigned char *buf, size_t buflen)
|
|
if (apdu.resplen == 0x100 && rbuf[0]==0 && rbuf[1]==0)
|
|
LOG_FUNC_RETURN(card->ctx, 0);
|
|
|
|
- buflen = buflen < apdu.resplen ? buflen : apdu.resplen;
|
|
+ buflen = MIN(buflen, apdu.resplen);
|
|
memcpy(buf, rbuf, buflen);
|
|
|
|
LOG_FUNC_RETURN(card->ctx, (int)buflen);
|
|
@@ -1133,7 +1133,7 @@ auth_compute_signature(struct sc_card *card, const unsigned char *in, size_t ile
|
|
apdu.datalen = ilen;
|
|
apdu.data = in;
|
|
apdu.lc = ilen;
|
|
- apdu.le = olen > 256 ? 256 : olen;
|
|
+ apdu.le = MIN(olen, 256);
|
|
apdu.resp = resp;
|
|
apdu.resplen = SC_MAX_APDU_BUFFER_SIZE;
|
|
|
|
@@ -2246,7 +2246,7 @@ auth_read_record(struct sc_card *card, unsigned int nr_rec, unsigned int idx,
|
|
if (flags & SC_RECORD_BY_REC_NR)
|
|
apdu.p2 |= 0x04;
|
|
|
|
- apdu.le = count > SC_MAX_APDU_BUFFER_SIZE ? SC_MAX_APDU_BUFFER_SIZE : count;
|
|
+ apdu.le = MIN(count, SC_MAX_APDU_BUFFER_SIZE);
|
|
apdu.resplen = SC_MAX_APDU_BUFFER_SIZE;
|
|
apdu.resp = recvbuf;
|
|
|