From bf0abf3ee1788ca4495def3c67d00032f4d2e114 Mon Sep 17 00:00:00 2001 From: q0jt <89930816+q0jt@users.noreply.github.com> Date: Sat, 14 Mar 2026 03:22:42 +0900 Subject: [PATCH 1/3] Fix avoid double free in CmdHFFelicaReader --- client/src/cmdhffelica.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/client/src/cmdhffelica.c b/client/src/cmdhffelica.c index d74b58ef5..8c3e472dc 100644 --- a/client/src/cmdhffelica.c +++ b/client/src/cmdhffelica.c @@ -795,8 +795,7 @@ static int CmdHFFelicaReader(const char *Cmd) { if (cm) { PrintAndLogEx(INFO, "Press " _GREEN_("") " to exit"); } - - CLIParserFree(ctx); + return read_felica_uid(cm, verbose); } From 08a90b9eba6dc87abc311d84660b33ac10f21e3f Mon Sep 17 00:00:00 2001 From: q0jt <89930816+q0jt@users.noreply.github.com> Date: Sat, 14 Mar 2026 03:36:57 +0900 Subject: [PATCH 2/3] Fix correct status flag error handling in authentication flow --- client/src/cmdhffelica.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/src/cmdhffelica.c b/client/src/cmdhffelica.c index 8c3e472dc..9df72f7ea 100644 --- a/client/src/cmdhffelica.c +++ b/client/src/cmdhffelica.c @@ -4200,7 +4200,7 @@ static int felica_internal_authentication( return PM3_ERFTRANS; } - if (res.status_flags.status_flag1[0] != 0x00 && res.status_flags.status_flag2[0] != 0x00) { + if (res.status_flags.status_flag1[0] != 0x00 || res.status_flags.status_flag2[0] != 0x00) { PrintAndLogEx(ERR, "\nError RC Write"); return PM3_ERFTRANS; } @@ -4329,7 +4329,7 @@ static int felica_external_authentication( return PM3_ERFTRANS; } - if (res.status_flags.status_flag1[0] != 0x00 && res.status_flags.status_flag2[0] != 0x00) { + if (res.status_flags.status_flag1[0] != 0x00 || res.status_flags.status_flag2[0] != 0x00) { PrintAndLogEx(ERR, "\nExternal Authenticate: " _RED_("Failed")); return PM3_ERFTRANS; } From 661634649a7e2bc4d11aca1bba9ab9d15b9cd554 Mon Sep 17 00:00:00 2001 From: q0jt <89930816+q0jt@users.noreply.github.com> Date: Sat, 14 Mar 2026 03:45:22 +0900 Subject: [PATCH 3/3] Fix reject responses with invalid CRC --- client/src/cmdhffelica.c | 1 + 1 file changed, 1 insertion(+) diff --git a/client/src/cmdhffelica.c b/client/src/cmdhffelica.c index 9df72f7ea..aa1be7309 100644 --- a/client/src/cmdhffelica.c +++ b/client/src/cmdhffelica.c @@ -610,6 +610,7 @@ static bool waitCmdFelicaEx(bool iSelect, PacketResponseNG *resp, bool verbose, if (logging) { PrintAndLogEx(WARNING, "CRC ( " _RED_("fail") " )"); } + return false; } if (resp->data.asBytes[0] != 0xB2 || resp->data.asBytes[1] != 0x4D) {