From fd4c54b4571b2e1593a8331906b5f0ca2aa39283 Mon Sep 17 00:00:00 2001 From: Frank Morgner Date: Thu, 22 May 2025 00:24:32 +0200 Subject: [PATCH] fixed Stack-buffer-overflow WRITE in GET RESPONSE The do-while loop in apdu.c requires the output data to be set in any case, otherwise non existent data may be copied to the output data. fixes https://issues.oss-fuzz.com/issues/416351800 fixes https://issues.oss-fuzz.com/issues/416295951 (cherry picked from commit 953986f65db61871bbbff72788d861d67d5140c6) CVE: CVE-2025-49010 Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/953986f65db61871bbbff72788d861d67d5140c6] Signed-off-by: Ankur Tyagi --- src/libopensc/card-nqApplet.c | 11 ++++++----- src/libopensc/iso7816.c | 5 +++-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/src/libopensc/card-nqApplet.c b/src/libopensc/card-nqApplet.c index f9075b948..90706f4b1 100644 --- a/src/libopensc/card-nqApplet.c +++ b/src/libopensc/card-nqApplet.c @@ -190,9 +190,10 @@ static int nqapplet_finish(struct sc_card *card) LOG_FUNC_RETURN(card->ctx, SC_SUCCESS); } -static int nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp) +static int +nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp) { - struct sc_apdu apdu; + struct sc_apdu apdu = {0}; int rv; size_t resplen; @@ -204,12 +205,12 @@ static int nqapplet_get_response(struct sc_card *card, size_t *cb_resp, u8 *resp rv = sc_transmit_apdu(card, &apdu); LOG_TEST_RET(card->ctx, rv, "APDU transmit failed"); - if (apdu.resplen == 0) { - LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); - } *cb_resp = apdu.resplen; + if (apdu.resplen == 0) { + LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); + } if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) { rv = SC_SUCCESS; } else if (apdu.sw1 == 0x61) { diff --git a/src/libopensc/iso7816.c b/src/libopensc/iso7816.c index 2fea84078..dc2f03c00 100644 --- a/src/libopensc/iso7816.c +++ b/src/libopensc/iso7816.c @@ -920,11 +920,12 @@ iso7816_get_response(struct sc_card *card, size_t *count, u8 *buf) r = sc_transmit_apdu(card, &apdu); LOG_TEST_RET(card->ctx, r, "APDU transmit failed"); - if (apdu.resplen == 0) - LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); *count = apdu.resplen; + if (apdu.resplen == 0) { + LOG_FUNC_RETURN(card->ctx, sc_check_sw(card, apdu.sw1, apdu.sw2)); + } if (apdu.sw1 == 0x90 && apdu.sw2 == 0x00) r = 0; /* no more data to read */ else if (apdu.sw1 == 0x61)