SCardControl() should return SCARD_E_INSUFFICIENT_BUFFER similar to SCardTransmit()
Maximilian Stein <[email protected]> Fri, 17 Feb 2017 20:24:27 +0100
| Newsgroups | gmane.comp.lib.muscle |
|---|---|
| Message-ID | <[email protected]> |
Hello, I think SCardControl() should work similar to SCardTransmit() regarding client application buffer size as in commit [1]. Depending on the underlying IFD handler the current implementation might cause the same incorrect behaviour as described in [1]. If the underlying IFD Handler is not correctly checking the buffer size, the current implementation could even cause a buffer overflow in the client application. The attached patch solves this similar to the fix in [1]. Kind regards Maximilian Stein [1] 8eb9ea1b354b050f997d003cf3b0c5b56f29f9f7 - SCardTransmit() may return SCARD_E_INSUFFICIENT_BUFFER _______________________________________________ Pcsclite-muscle mailing list [email protected] http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle
scardcontrol_insufficient_buffer.patch
(text/x-patch, 1.6 KB)
diff --git a/src/winscard_clnt.c b/src/winscard_clnt.c index f79ea46..04e5394 100644 --- a/src/winscard_clnt.c +++ b/src/winscard_clnt.c @@ -2178,7 +2178,7 @@ error: * * @return Error code. * @retval SCARD_S_SUCCESS Successful (\ref SCARD_S_SUCCESS) - * @retval SCARD_E_INSUFFICIENT_BUFFER \p cbSendLength or \p cbRecvLength are too big (\ref SCARD_E_INSUFFICIENT_BUFFER) + * @retval SCARD_E_INSUFFICIENT_BUFFER \p cbRecvLength was not large enough for the reader response. The expected size is now in \p lpBytesReturned (\ref SCARD_E_INSUFFICIENT_BUFFER) * @retval SCARD_E_INVALID_HANDLE Invalid \p hCard handle (\ref SCARD_E_INVALID_HANDLE) * @retval SCARD_E_INVALID_PARAMETER \p pbSendBuffer is NULL or \p cbSendLength is null and the IFDHandler is version 2.0 (without \p dwControlCode) (\ref SCARD_E_INVALID_PARAMETER) * @retval SCARD_E_INVALID_VALUE Invalid value was presented (\ref SCARD_E_INVALID_VALUE) diff --git a/src/winscard_svc.c b/src/winscard_svc.c index a8f027c..8417015 100644 --- a/src/winscard_svc.c +++ b/src/winscard_svc.c @@ -715,9 +715,15 @@ static void ContextThread(LPVOID newContext) ctStr.rv = SCardControl(ctStr.hCard, ctStr.dwControlCode, pbSendBuffer, ctStr.cbSendLength, - pbRecvBuffer, ctStr.cbRecvLength, + pbRecvBuffer, sizeof(pbRecvBuffer), &dwBytesReturned); + if (dwBytesReturned > ctStr.cbRecvLength) + /* The client buffer is not large enough. + * The pbRecvBuffer buffer will NOT be sent a few + * lines bellow. So no buffer overflow is expected. */ + ctStr.rv = SCARD_E_INSUFFICIENT_BUFFER; + ctStr.dwBytesReturned = dwBytesReturned; WRITE_BODY(ctStr);