From b54c06a463d50741d058b5b0a4455528baa34638 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 29 Mar 2026 09:39:02 +0700 Subject: [PATCH] fix a missing free, and out of band reading if called with large index which was guarded at the caller before. --- client/src/cmdhficlass.c | 40 +++++++++++++++++++++++----------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 3d4de6a58..1c5c24955 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -279,8 +279,8 @@ static uint8_t card_app2_limit[] = { 0xff, }; -static iclass_config_card_item_t iclass_config_options[33] = { - //Byte A8 - LED Operations +static iclass_config_card_item_t iclass_config_options[] = { + // Byte A8 - LED Operations {"(LED) - Led idle (Off) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(LED) - Led idle (Red) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x1F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(LED) - Led idle (Grn) / Led read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0x2F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, @@ -297,43 +297,44 @@ static iclass_config_card_item_t iclass_config_options[33] = { {"(LED) - Led idle (Red) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xDF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(LED) - Led idle (Grn) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(LED) - Led idle (Amber) / Led read (Amber)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA8, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, - //Byte A9 - Potentially associated with led blinking / led heartbeat operations? - //Byte A6 - Potentially associated with beep pitch? - //Byte A7 - BEEP Operations + // Byte A9 - Potentially associated with led blinking / led heartbeat operations? + // Byte A6 - Potentially associated with beep pitch? + // Byte A7 - BEEP Operations {"(BEEP) - Beep on Read (On)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA7, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(BEEP) - Beep on Read (Off)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xA7, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, - //Byte AC - MIFARE CSN Operations + // Byte AC - MIFARE CSN Operations {"(MIFARE) - CSN Default Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(MIFARE) - CSN 32 bit Reverse Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(MIFARE) - CSN 16 bit Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(MIFARE) - CSN 34 bit Output", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAC, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, - //Bytes AD, AE, AF, B3 - Keypad Operations + not fully mapped + // Bytes AD, AE, AF, B3 - Keypad Operations + not fully mapped {"(KEYPAD Output) - Buffer ONE key (8 bit Dorado)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAE, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(KEYPAD Output) - Buffer ONE to FIVE keys (standard 26 bit)", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAE, 0x0B, 0xAF, 0xFF, 0xAD, 0x15, 0xB3, 0x03}}, {"(KEYPAD Output) - Local PIN verify", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xBF, 0x18, 0xAD, 0x6D, 0xB3, 0x03, 0x00, 0x00, 0x00, 0x00}}, - //iClass Elite Key Operations + // iClass Elite Key Operations {"(ELITE Key) - Set ELITE Key and Enable Dual key (Elite + Standard)", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}}, {"(ELITE Key) - Set ELITE Key and ENABLE Keyrolling", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x03, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}}, {"(ELITE Key) - Set ELITE Key and DISABLE Standard Key", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x05, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}}, - //Erroneous / incorrect reader behaviors (read below) - //Elite Bugger: - //Sets block 3 of card 0 presented to the reader to 0, sets block 3 of card 1 presented to the reader to the original value of card 0's block 3 - //Continues setting block 3 of presented cards to block 3 of the previous card the reader scanned - //This renders cards unreadable and hardly recoverable unless the order of the scanned cards is known. + // Erroneous / incorrect reader behaviors (read below) + // Elite Bugger: + // Sets block 3 of card 0 presented to the reader to 0, sets block 3 of card 1 presented to the reader to the original value of card 0's block 3 + // Continues setting block 3 of presented cards to block 3 of the previous card the reader scanned + // This renders cards unreadable and hardly recoverable unless the order of the scanned cards is known. {"(ELITE Bugger) - Renders cards unusable.", {0x0C, 0x00, 0x00, 0x01, 0x00, 0x00, 0xBF, 0x18, 0xBF, 0x02, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}}, - //Reset Operations + // Reset Operations {"(RESET) - Reset READER to defaults", {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, {"(RESET) - Reset ENROLLER to defaults", {0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0xFF, 0xFF, 0xFF}}, - //Reader Master Key Operations + // Reader Master Key Operations {"(MASTER Key) - Change Reader Master Key to Custom Key", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}}, - {"(MASTER Key) - Restore Reader Master Key to Factory Defaults", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0xE0, 0x5C, 0x91, 0xCF, 0x63, 0x34, 0x23, 0xB9}} + {"(MASTER Key) - Restore Reader Master Key to Factory Defaults", {0x28, 0xCB, 0x91, 0x9D, 0x00, 0x00, 0x00, 0x1C, 0xE0, 0x5C, 0x91, 0xCF, 0x63, 0x34, 0x23, 0xB9}}, + {"", {0}}, // must be the last item }; static const iclass_config_card_item_t *get_config_card_item(int idx) { if (idx > -1 && idx < ARRAYLEN(iclass_config_options)) { return &iclass_config_options[idx]; } - return &iclass_config_options[ARRAYLEN(iclass_config_options)]; + return &iclass_config_options[ARRAYLEN(iclass_config_options) - 1]; } static void print_config_cards(void) { @@ -7068,6 +7069,7 @@ static void generate(uint8_t *data, uint8_t len) { uint8_t *pkey = calloc(len, sizeof(uint8_t)); if (pkey == NULL) { PrintAndLogEx(WARNING, "Failed to allocate memory"); + free(key); return; } @@ -7470,6 +7472,10 @@ static int CmdHFiClassConfigCard(const char *Cmd) { if (ccidx > -1 && ccidx < ARRAYLEN(iclass_config_options)) { const iclass_config_card_item_t *item = get_config_card_item(ccidx); + if (strlen(item->desc) == 0) { + PrintAndLogEx(ERR, "out of range, %u (got %u)", ARRAYLEN(iclass_config_options), ccidx); + return PM3_EINVARG; + } if (strstr(item->desc, "ELITE") != NULL && got_kr == false) { PrintAndLogEx(ERR, "please specify ELITE Key (--eki) !"); return PM3_EINVARG;