SCardControl() should return SCARD_E_INSUFFICIENT_BUFFER similar to SCardTransmit()

Maximilian Stein <[email protected]> Fri, 17 Feb 2017 20:24:27 +0100
Newsgroups gmane.comp.lib.muscle
Message-ID <[email protected]>
Hello,

I think SCardControl() should work similar to SCardTransmit() regarding
client application buffer size as in commit [1]. Depending on the
underlying IFD handler the current implementation might cause the same
incorrect behaviour as described in [1].

If the underlying IFD Handler is not correctly checking the buffer size,
the current implementation could even cause a buffer overflow in the
client application.

The attached patch solves this similar to the fix in [1].


Kind regards
Maximilian Stein

[1] 8eb9ea1b354b050f997d003cf3b0c5b56f29f9f7 - SCardTransmit() may
return SCARD_E_INSUFFICIENT_BUFFER

_______________________________________________
Pcsclite-muscle mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pcsclite-muscle
scardcontrol_insufficient_buffer.patch (text/x-patch, 1.6 KB)
diff --git a/src/winscard_clnt.c b/src/winscard_clnt.c
index f79ea46..04e5394 100644
--- a/src/winscard_clnt.c
+++ b/src/winscard_clnt.c
@@ -2178,7 +2178,7 @@ error:
  *
  * @return Error code.
  * @retval SCARD_S_SUCCESS Successful (\ref SCARD_S_SUCCESS)
- * @retval SCARD_E_INSUFFICIENT_BUFFER \p cbSendLength or \p cbRecvLength are too big (\ref SCARD_E_INSUFFICIENT_BUFFER)
+ * @retval SCARD_E_INSUFFICIENT_BUFFER \p cbRecvLength was not large enough for the reader response. The expected size is now in \p lpBytesReturned (\ref SCARD_E_INSUFFICIENT_BUFFER)
  * @retval SCARD_E_INVALID_HANDLE Invalid \p hCard handle (\ref SCARD_E_INVALID_HANDLE)
  * @retval SCARD_E_INVALID_PARAMETER \p pbSendBuffer is NULL or \p cbSendLength is null and the IFDHandler is version 2.0 (without \p dwControlCode) (\ref SCARD_E_INVALID_PARAMETER)
  * @retval SCARD_E_INVALID_VALUE Invalid value was presented (\ref SCARD_E_INVALID_VALUE)
diff --git a/src/winscard_svc.c b/src/winscard_svc.c
index a8f027c..8417015 100644
--- a/src/winscard_svc.c
+++ b/src/winscard_svc.c
@@ -715,9 +715,15 @@ static void ContextThread(LPVOID newContext)
 
 				ctStr.rv = SCardControl(ctStr.hCard, ctStr.dwControlCode,
 					pbSendBuffer, ctStr.cbSendLength,
-					pbRecvBuffer, ctStr.cbRecvLength,
+					pbRecvBuffer, sizeof(pbRecvBuffer),
 					&dwBytesReturned);
 
+				if (dwBytesReturned > ctStr.cbRecvLength)
+					/* The client buffer is not large enough.
+					 * The pbRecvBuffer buffer will NOT be sent a few
+					 * lines bellow. So no buffer overflow is expected. */
+					ctStr.rv = SCARD_E_INSUFFICIENT_BUFFER;
+
 				ctStr.dwBytesReturned = dwBytesReturned;
 
 				WRITE_BODY(ctStr);