librekeys/pico-fido
0
0
Fork 0
mirror of https://github.com/librekeys/pico-fido.git synced 2026-07-28 08:01:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2 from gxcreator/fix_transports_parsing

Browse Source 
fix(cred_mgmt): check array bounds when populating credentialId.trans…
This commit is contained in:
Fabrice Bellamy
2026-03-02 23:47:30 +01:00
committed by GitHub
parent 0ed3c4a6b0 3e43e8b839
commit 122b439c27
4 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/fido/cbor_cred_mgmt.c
+3
View File
@@ -79,6 +79,9 @@ int cbor_cred_mgmt(const uint8_t *data, size_t len) {
if (strcmp(_fd3, "transports") == 0) {
CBOR_PARSE_ARRAY_START(_f3, 4)
{
if (credentialId.transports_len >= MAX_TRANSPORT_COUNT) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
CBOR_FIELD_GET_TEXT(credentialId.transports[credentialId.transports_len], 4);
credentialId.transports_len++;
}
src/fido/cbor_get_assertion.c
+12
View File
@@ -124,6 +124,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
else if (val_u == 0x03) { // excludeList
CBOR_PARSE_ARRAY_START(_f1, 2)
{
if (allowList_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
PublicKeyCredentialDescriptor *pc = &allowList[allowList_len];
CBOR_PARSE_MAP_START(_f2, 3)
{
@@ -133,6 +136,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
if (strcmp(_fd3, "transports") == 0) {
CBOR_PARSE_ARRAY_START(_f3, 4)
{
if (pc->transports_len >= MAX_TRANSPORT_COUNT) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
CBOR_FIELD_GET_TEXT(pc->transports[pc->transports_len], 4);
pc->transports_len++;
}
@@ -481,6 +487,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
}
numberOfCredentialsx = numberOfCredentials;
datax = (uint8_t *) calloc(1, len);
if (datax == NULL) {
CBOR_ERROR(CTAP1_ERR_OTHER);
}
memcpy(datax, data, len);
lenx = len;
flagsx = flags;
@@ -608,6 +617,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
size_t aut_data_len = 32 + 1 + 4 + ext_len;
aut_data = (uint8_t *) calloc(1, aut_data_len + clientDataHash.len);
if (aut_data == NULL) {
CBOR_ERROR(CTAP1_ERR_OTHER);
}
uint8_t *pa = aut_data;
memcpy(pa, rp_id_hash, 32); pa += 32;
*pa++ = flags;
src/fido/cbor_make_credential.c
+9
View File
@@ -92,6 +92,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
else if (val_u == 0x04) { // pubKeyCredParams
CBOR_PARSE_ARRAY_START(_f1, 2)
{
if (pubKeyCredParams_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
PublicKeyCredentialParameters *pk = &pubKeyCredParams[pubKeyCredParams_len];
CBOR_PARSE_MAP_START(_f2, 3)
{
@@ -107,6 +110,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
else if (val_u == 0x05) { // excludeList
CBOR_PARSE_ARRAY_START(_f1, 2)
{
if (excludeList_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
PublicKeyCredentialDescriptor *pc = &excludeList[excludeList_len];
CBOR_PARSE_MAP_START(_f2, 3)
{
@@ -116,6 +122,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
if (strcmp(_fd3, "transports") == 0) {
CBOR_PARSE_ARRAY_START(_f3, 4)
{
if (pc->transports_len >= MAX_TRANSPORT_COUNT) {
CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
}
CBOR_FIELD_GET_TEXT(pc->transports[pc->transports_len], 4);
pc->transports_len++;
}
src/fido/cbor_make_credential.h
+3 -1
View File
@@ -40,10 +40,12 @@ typedef struct PublicKeyCredentialParameters {
int64_t alg;
} PublicKeyCredentialParameters;
#define MAX_TRANSPORT_COUNT 8
typedef struct PublicKeyCredentialDescriptor {
CborCharString type;
CborByteString id;
CborCharString transports[8];
CborCharString transports[MAX_TRANSPORT_COUNT];
size_t transports_len;
} PublicKeyCredentialDescriptor;