[PATCH 06/27] hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num()

atr_get_protocol_num() computes the TD1 offset from the T0 presence bits
without checking that the byte exists in the ATR buffer. A truncated ATR
causes an out-of-bounds read.

Validate the offset before dereferencing and fall back to T=0.

This is only triggerable by a buggy backend.

Fixes: 2f8f916b6d44 ("dev-smartcard-reader: copy atr protocol to ccid parameters")
Signed-off-by: Marc-André Lureau <[email protected]>
---
 hw/usb/dev-smartcard-reader.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index a14062948071..a147cd19f388 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -836,6 +836,9 @@ static uint8_t atr_get_protocol_num(const uint8_t *atr, uint32_t len)
     }
     i = 1 + !!(atr[1] & 0x10) + !!(atr[1] & 0x20) + !!(atr[1] & 0x40);
     i += !!(atr[1] & 0x80);
+    if (i >= len) {
+        return 0;
+    }
     return atr[i] & 0x0f;
 }
 

-- 
2.55.0