From ad82c50158a7c559119b0334f7824e3410fccea1 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 29 Mar 2026 10:20:30 +0700 Subject: [PATCH] enforce NULL checks after all malloc, calloc, realloc --- client/src/cmddata.c | 4 ++++ client/src/cmdflashmem.c | 4 ++++ client/src/cmdhfmf.c | 4 ++++ client/src/cmdlf.c | 15 +++++++++++++ client/src/cmdlfem4x05.c | 5 +++++ client/src/cmdlffdxb.c | 5 +++++ client/src/cmdlfidteck.c | 5 +++++ client/src/cmdmain.c | 7 ++++++ client/src/cmdtrace.c | 37 +++++++++++++++++++++++--------- client/src/crypto/libpcrypto.c | 12 ++++++++++- client/src/emv/emv_pk.c | 15 ++++++++++++- client/src/loclass/cipherutils.c | 9 +++++++- client/src/wiegand_formats.c | 5 +++++ 13 files changed, 114 insertions(+), 13 deletions(-) diff --git a/client/src/cmddata.c b/client/src/cmddata.c index bb6c3e9fd..064f5b971 100644 --- a/client/src/cmddata.c +++ b/client/src/cmddata.c @@ -866,6 +866,10 @@ int AutoCorrelate(const int *in, int *out, size_t len, size_t window, bool SaveG double variance = compute_variance(in, len); int *correl_buf = calloc(MAX_GRAPH_TRACE_LEN, sizeof(int)); + if (correl_buf == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return -1; + } uint8_t peak_cnt = 0; size_t peaks[10] = {0}; diff --git a/client/src/cmdflashmem.c b/client/src/cmdflashmem.c index c6566e333..f56ba7e65 100644 --- a/client/src/cmdflashmem.c +++ b/client/src/cmdflashmem.c @@ -373,6 +373,10 @@ static int CmdFlashMemLoad(const char *Cmd) { uint32_t keycount = 0; uint8_t keylen = 0; uint8_t *data = calloc(FLASH_MEM_MAX_SIZE_P(spi_flash_pages), sizeof(uint8_t)); + if (data == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } char spiffsDest[32] = {0}; diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c index b3db4e784..88a77d383 100644 --- a/client/src/cmdhfmf.c +++ b/client/src/cmdhfmf.c @@ -440,6 +440,10 @@ static char *GenerateFilename(const char *prefix, const char *suffix) { uint8_t uid[10] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; int uidlen = 0; char *fptr = calloc(sizeof(char) * (strlen(prefix) + strlen(suffix)) + sizeof(uid) * 2 + 1, sizeof(uint8_t)); + if (fptr == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return NULL; + } int res = mf_read_uid(uid, &uidlen, NULL); if (res != PM3_SUCCESS || !uidlen) { diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c index 09fd88b5a..f3c03dde0 100644 --- a/client/src/cmdlf.c +++ b/client/src/cmdlf.c @@ -1196,6 +1196,11 @@ int CmdLFfskSim(const char *Cmd) { } lf_fsksim_t *payload = calloc(1, sizeof(lf_fsksim_t) + size); + if (payload == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + payload->fchigh = fchigh; payload->fclow = fclow; payload->separator = separator; @@ -1308,6 +1313,11 @@ int CmdLFaskSim(const char *Cmd) { } lf_asksim_t *payload = calloc(1, sizeof(lf_asksim_t) + size); + if (payload == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + payload->encoding = encoding; payload->invert = invert; payload->separator = separator; @@ -1439,6 +1449,11 @@ int CmdLFpskSim(const char *Cmd) { } lf_psksim_t *payload = calloc(1, sizeof(lf_psksim_t) + size); + if (payload == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + payload->carrier = carrier; payload->invert = invert; payload->clock = clk; diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index 11589d881..f7bfe54c7 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -2391,6 +2391,11 @@ int CmdEM4x05Sniff(const char *Cmd) { smartbuf bits = { 0 }; bits.ptr = calloc(EM4X05_BITS_BUFSIZE, sizeof(uint8_t)); + if (bits.ptr == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + bits.size = EM4X05_BITS_BUFSIZE; bits.idx = 0; size_t idx = 0; diff --git a/client/src/cmdlffdxb.c b/client/src/cmdlffdxb.c index 894adf266..b541724c8 100644 --- a/client/src/cmdlffdxb.c +++ b/client/src/cmdlffdxb.c @@ -763,6 +763,11 @@ static int CmdFdxBClone(const char *Cmd) { PrintAndLogEx(INFO, "RFU................. 0"); uint8_t *bs = calloc(128, sizeof(uint8_t)); + if (bs == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + if (getFDXBBits(national_code, country_code, is_animal, has_extended, extended, bs) != PM3_SUCCESS) { PrintAndLogEx(ERR, "Error with tag bitstream generation."); free(bs); diff --git a/client/src/cmdlfidteck.c b/client/src/cmdlfidteck.c index b6976fe4d..9fbe6a490 100644 --- a/client/src/cmdlfidteck.c +++ b/client/src/cmdlfidteck.c @@ -273,6 +273,11 @@ static int CmdIdteckSim(const char *Cmd) { PrintAndLogEx(NORMAL, ""); lf_psksim_t *payload = calloc(1, sizeof(lf_psksim_t) + sizeof(bs)); + if (payload == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + payload->carrier = 2; payload->invert = 0; payload->clock = 32; diff --git a/client/src/cmdmain.c b/client/src/cmdmain.c index 9ab88324b..21dd08180 100644 --- a/client/src/cmdmain.c +++ b/client/src/cmdmain.c @@ -173,8 +173,15 @@ static int CmdAuto(const char *Cmd) { PrintAndLogEx(INFO, "Trying " _YELLOW_("`lf read`") " and save a trace for you"); CmdPlot(""); + lf_read(false, 40000); + char *fname = calloc(100, sizeof(uint8_t)); + if (fname == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return PM3_EMALLOC; + } + AppendDate(fname, 100, "-f lf_unknown_%Y-%m-%d_%H:%M"); CmdSave(fname); free(fname); diff --git a/client/src/cmdtrace.c b/client/src/cmdtrace.c index d0f7aed2b..6405d7ad4 100644 --- a/client/src/cmdtrace.c +++ b/client/src/cmdtrace.c @@ -1499,26 +1499,36 @@ int CmdTraceList(const char *Cmd) { const uint64_t *dicKeys = NULL; uint32_t dicKeysCount = 0; - bool dictionaryLoad = false; + bool load_dictionary = false; if (protocol == PROTO_MIFARE || protocol == PROTO_MFPLUS) { + if (diclen > 0) { + uint8_t *keyBlock = NULL; + int res = loadFileDICTIONARY_safe(dictionary, (void **) &keyBlock, 6, &dicKeysCount); if (res != PM3_SUCCESS || dicKeysCount == 0 || keyBlock == NULL) { PrintAndLogEx(FAILED, "An error occurred while loading the dictionary! (we will use the default keys now)"); } else { + dicKeys = calloc(dicKeysCount, sizeof(uint64_t)); - for (int i = 0; i < dicKeysCount; i++) { - uint64_t key = bytes_to_num(keyBlock + i * 6, 6); - memcpy((uint8_t *) &dicKeys[i], &key, sizeof(uint64_t)); + if (dicKeys == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + } else { + for (int i = 0; i < dicKeysCount; i++) { + uint64_t key = bytes_to_num(keyBlock + i * 6, 6); + memcpy((uint8_t *) &dicKeys[i], &key, sizeof(uint64_t)); + } + load_dictionary = true; } - dictionaryLoad = true; } + if (keyBlock != NULL) { free(keyBlock); } } + if (dicKeys == NULL) { dicKeys = g_mifare_default_keys; dicKeysCount = ARRAYLEN(g_mifare_default_keys); @@ -1533,17 +1543,24 @@ int CmdTraceList(const char *Cmd) { // load keys uint8_t *keyBlock = NULL; + int res = loadFileDICTIONARY_safe(dictionary, (void **) &keyBlock, HITAG_CRYPTOKEY_SIZE, &dicKeysCount); if (res != PM3_SUCCESS || dicKeysCount == 0 || keyBlock == NULL) { PrintAndLogEx(FAILED, "An error occurred while loading the dictionary!"); } else { + dicKeys = calloc(dicKeysCount, sizeof(uint64_t)); - for (int i = 0; i < dicKeysCount; i++) { - uint64_t key = bytes_to_num(keyBlock + i * HITAG_CRYPTOKEY_SIZE, HITAG_CRYPTOKEY_SIZE); - memcpy((uint8_t *) &dicKeys[i], &key, sizeof(uint64_t)); + if (dicKeys == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + } else { + for (int i = 0; i < dicKeysCount; i++) { + uint64_t key = bytes_to_num(keyBlock + i * HITAG_CRYPTOKEY_SIZE, HITAG_CRYPTOKEY_SIZE); + memcpy((uint8_t *) &dicKeys[i], &key, sizeof(uint64_t)); + } + load_dictionary = true; } - dictionaryLoad = true; } + if (keyBlock != NULL) { free(keyBlock); } @@ -1582,7 +1599,7 @@ int CmdTraceList(const char *Cmd) { } } - if (dictionaryLoad) { + if (load_dictionary) { free((void *) dicKeys); } } diff --git a/client/src/crypto/libpcrypto.c b/client/src/crypto/libpcrypto.c index 748c29ee9..d242e8424 100644 --- a/client/src/crypto/libpcrypto.c +++ b/client/src/crypto/libpcrypto.c @@ -1040,9 +1040,12 @@ exit: return res; } + +// iceman: todo, remove and use xor in commonutil.c void bin_xor(uint8_t *d1, const uint8_t *d2, size_t len) { - for (size_t i = 0; i < len; i++) + for (size_t i = 0; i < len; i++) { d1[i] = d1[i] ^ d2[i]; + } } void AddISO9797M2Padding(uint8_t *ddata, size_t *ddatalen, uint8_t *sdata, size_t sdatalen, size_t blocklen) { @@ -1093,7 +1096,13 @@ int ansi_x963_sha256(uint8_t *sharedSecret, size_t sharedSecretLen, uint8_t *sha uint32_t counter = 0x00000001; for (int i = 0; i < (keyDataLen / 32); ++i) { + uint8_t *hashMaterial = calloc(4 + sharedSecretLen + sharedInfoLen, sizeof(uint8_t)); + if (hashMaterial == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return 2; + } + memcpy(hashMaterial, sharedSecret, sharedSecretLen); hashMaterial[sharedSecretLen] = (counter >> 24); hashMaterial[sharedSecretLen + 1] = (counter >> 16) & 0xFF; @@ -1103,6 +1112,7 @@ int ansi_x963_sha256(uint8_t *sharedSecret, size_t sharedSecretLen, uint8_t *sha uint8_t hash[32] = {0}; sha256hash(hashMaterial, 4 + sharedSecretLen + sharedInfoLen, hash); + free(hashMaterial); memcpy(keyData + (32 * i), hash, 32); diff --git a/client/src/emv/emv_pk.c b/client/src/emv/emv_pk.c index eacd3db36..e60a332f1 100644 --- a/client/src/emv/emv_pk.c +++ b/client/src/emv/emv_pk.c @@ -168,32 +168,38 @@ static ssize_t emv_pk_read_string(char *buf, size_t buflen, char *str, size_t si } struct emv_pk *emv_pk_parse_pk(char *buf, size_t buflen) { + struct emv_pk *r = calloc(1, sizeof(*r)); if (r == NULL) { PrintAndLogEx(WARNING, "Failed to allocate memory"); return NULL; } + ssize_t l; - char temp[10]; + char temp[10] = {0}; l = emv_pk_read_bin(buf, buflen, r->rid, 5, NULL); if (l <= 0) goto out; + buf += l; l = emv_pk_read_bin(buf, buflen, &r->index, 1, NULL); if (l <= 0) goto out; + buf += l; l = emv_pk_read_ymv(buf, buflen, &r->expire); if (l <= 0) goto out; + buf += l; l = emv_pk_read_string(buf, buflen, temp, sizeof(temp)); if (l <= 0) goto out; + buf += l; if (!strcmp(temp, "rsa")) @@ -204,17 +210,24 @@ struct emv_pk *emv_pk_parse_pk(char *buf, size_t buflen) { l = emv_pk_read_bin(buf, buflen, r->exp, sizeof(r->exp), &r->elen); if (l <= 0) goto out; + buf += l; + // 256 bytes r->modulus = calloc(1, (2048 / 8)); + if (r->modulus == NULL) + goto out; + l = emv_pk_read_bin(buf, buflen, r->modulus, 2048 / 8, &r->mlen); if (l <= 0) goto out2; + buf += l; l = emv_pk_read_string(buf, buflen, temp, sizeof(temp)); if (l <= 0) goto out2; + buf += l; if (!strcmp(temp, "sha1")) diff --git a/client/src/loclass/cipherutils.c b/client/src/loclass/cipherutils.c index 2ff42274d..fea18e86b 100644 --- a/client/src/loclass/cipherutils.c +++ b/client/src/loclass/cipherutils.c @@ -161,9 +161,16 @@ void printarr_human_readable(const char *title, uint8_t *arr, int len) { return; } - int cx = 0, i; + int cx = 0; + int i; + size_t outsize = 100 + strlen(title) + (len * 4); char *output = calloc(outsize, sizeof(char)); + if (output == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return; + } + PrintAndLogEx(INFO, "%s", title); for (i = 0; i < len; i++) { diff --git a/client/src/wiegand_formats.c b/client/src/wiegand_formats.c index ea8af7603..8131b4d99 100644 --- a/client/src/wiegand_formats.c +++ b/client/src/wiegand_formats.c @@ -1487,6 +1487,11 @@ void print_desc_wiegand(cardformat_t *fmt, wiegand_message_t *packed) { size_t s_len = 128; char *s = calloc(s_len, sizeof(uint8_t)); + if (s == NULL) { + PrintAndLogEx(WARNING, "Failed to allocate memory"); + return; + } + snprintf(s, s_len * sizeof(uint8_t), _YELLOW_("%-10s")" %-32s", fmt->Name, fmt->Description); if (packed->Top != 0) {