From 08f82ebea28d5d3af715d053694bc8f4b5bfd4b2 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Wed, 25 Mar 2026 18:39:30 +0700 Subject: [PATCH] another u8 overflow, and sanity checks' --- armsrc/seos.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/armsrc/seos.c b/armsrc/seos.c index 1c92966fe..d308f1271 100644 --- a/armsrc/seos.c +++ b/armsrc/seos.c @@ -715,8 +715,8 @@ void SimulateSeos(seos_emulate_req_t *msg) { uint8_t *request = work_buffer_a; decrypt_cryptogram(diver_encr_key, cryptogram, cryptogram_length, request, msg->encr_alg); - uint8_t tlv_base = 1 + offset; - uint8_t tlv_idx = tlv_base; + uint16_t tlv_base = 1 + offset; + uint16_t tlv_idx = tlv_base; if (is_put) { // TODO: Add write support @@ -762,6 +762,12 @@ void SimulateSeos(seos_emulate_req_t *msg) { break; } + // Pre-flight: 2 (cryptogram tag+len) + reply_len + 4 (status) + 2 (CMAC tag+len) + recvd_cmac_length + if (tlv_base + 2 + reply_len + 4 + 2 + recvd_cmac_length > DYNAMIC_RESPONSE_BUFFER_SIZE) { + Dbprintf(_RED_("Get Data failed") ": Response too large for buffer."); + break; + } + // Only include a cryptogram for GET DATA dynamic_response_info.response[tlv_idx++] = 0x85; // Tag: cryptogram dynamic_response_info.response[tlv_idx++] = reply_len; // Length