rfidrig/proxmark3
0
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-05-12 11:18:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

another u8 overflow, and sanity checks'

Browse Source
This commit is contained in:
iceman1001
2026-03-25 18:39:30 +07:00
parent 87ad69abf8
commit 08f82ebea2
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
armsrc/seos.c
+8 -2
View File
@@ -715,8 +715,8 @@ void SimulateSeos(seos_emulate_req_t *msg) {
uint8_t *request = work_buffer_a;
decrypt_cryptogram(diver_encr_key, cryptogram, cryptogram_length, request, msg->encr_alg);
uint8_t tlv_base = 1 + offset;
uint8_t tlv_idx = tlv_base;
uint16_t tlv_base = 1 + offset;
uint16_t tlv_idx = tlv_base;
if (is_put) {
// TODO: Add write support
@@ -762,6 +762,12 @@ void SimulateSeos(seos_emulate_req_t *msg) {
break;
}
// Pre-flight: 2 (cryptogram tag+len) + reply_len + 4 (status) + 2 (CMAC tag+len) + recvd_cmac_length
if (tlv_base + 2 + reply_len + 4 + 2 + recvd_cmac_length > DYNAMIC_RESPONSE_BUFFER_SIZE) {
Dbprintf(_RED_("Get Data failed") ": Response too large for buffer.");
break;
}
// Only include a cryptogram for GET DATA
dynamic_response_info.response[tlv_idx++] = 0x85; // Tag: cryptogram
dynamic_response_info.response[tlv_idx++] = reply_len; // Length