From 5f8c904577cce1a6e21f793ba4aab1c473ff4136 Mon Sep 17 00:00:00 2001 From: Frank Morgner Date: Wed, 4 Jun 2025 01:07:56 +0200 Subject: [PATCH] oberthur: fixed potential Stack-buffer-overflow WRITE (cherry picked from commit 3402a90d8c9be223d4cf6abe009a4707117d7972) CVE: CVE-2025-66215 Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/3402a90d8c9be223d4cf6abe009a4707117d7972] Signed-off-by: Ankur Tyagi --- src/libopensc/card-oberthur.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/libopensc/card-oberthur.c b/src/libopensc/card-oberthur.c index a8aba7992..216640ebd 100644 --- a/src/libopensc/card-oberthur.c +++ b/src/libopensc/card-oberthur.c @@ -2246,14 +2246,16 @@ auth_read_record(struct sc_card *card, unsigned int nr_rec, unsigned int idx, if (flags & SC_RECORD_BY_REC_NR) apdu.p2 |= 0x04; - apdu.le = count; - apdu.resplen = count; + apdu.le = count > SC_MAX_APDU_BUFFER_SIZE ? SC_MAX_APDU_BUFFER_SIZE : count; + apdu.resplen = SC_MAX_APDU_BUFFER_SIZE; apdu.resp = recvbuf; rv = sc_transmit_apdu(card, &apdu); LOG_TEST_RET(card->ctx, rv, "APDU transmit failed"); if (apdu.resplen == 0) LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); + if (count < apdu.resplen) + LOG_FUNC_RETURN(card->ctx, SC_ERROR_WRONG_LENGTH); memcpy(buf, recvbuf, apdu.resplen); rv = sc_check_sw(card, apdu.sw1, apdu.sw2);