File opensc-oberthur-overflow2.patch of Package opensc.29261
From 05648b0604bf3e498e8d42dff3c6e7c56a5bf749 Mon Sep 17 00:00:00 2001 From: Frank Morgner <frankmorgner@gmail.com> Date: Wed, 17 Mar 2021 18:16:34 +0100 Subject: [PATCH 3/5] oberthur: fixed Heap-buffer-overflow fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32149 --- src/libopensc/pkcs15-oberthur.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Index: opensc-0.19.0/src/libopensc/pkcs15-oberthur.c =================================================================== --- opensc-0.19.0.orig/src/libopensc/pkcs15-oberthur.c +++ opensc-0.19.0/src/libopensc/pkcs15-oberthur.c @@ -600,10 +600,12 @@ sc_pkcs15emu_oberthur_add_pubkey(struct offs += 2 + len; /* ID */ - if (offs > info_len) + if (offs + 2 > info_len) LOG_TEST_RET(ctx, SC_ERROR_UNKNOWN_DATA_RECEIVED, "Failed to add public key: no 'ID'"); len = *(info_blob + offs + 1) + *(info_blob + offs) * 0x100; - if (!len || len > sizeof(key_info.id.value)) + if (len == 0 + || len > sizeof(key_info.id.value) + || offs + 2 + len > info_len) LOG_TEST_RET(ctx, SC_ERROR_INVALID_DATA, "Failed to add public key: invalid 'ID' length"); memcpy(key_info.id.value, info_blob + offs + 2, len); key_info.id.len = len;
