From 9ee9b1a73f19e1660d23d36daa5f182b1a82897b Mon Sep 17 00:00:00 2001
From: "Aaron Tulino (Aaronjamt)" <git@aaronjamt.com>
Date: Fri, 14 Nov 2025 20:44:04 -0700
Subject: [PATCH] Proper TLV parsing for Seos

---
 client/src/cmdhfseos.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/client/src/cmdhfseos.c b/client/src/cmdhfseos.c
index 5cb63a89b..aa661362c 100644
--- a/client/src/cmdhfseos.c
+++ b/client/src/cmdhfseos.c
@@ -550,14 +550,24 @@ static int select_DF_verify(uint8_t *response, uint8_t response_length, uint8_t
     // Extract everything before the 8E tag
 
     int res = PM3_EWRONGANSWER;
-    for (int i = 0; i < response_length; i++) {
+    for (int i = 0; i < response_length - 2;) {
         // extract MAC
         if (response[i] == 0x8E) {
+            if (response[i+1] != MAC_value_len) {
+                goto out;
+            }
+            // Ensure there's enough bytes remaining
+            // in the response for the full MAC
+            if (i+2+MAC_value_len > response_length) {
+                goto out;
+            }
             memcpy(input, response, i);
             memcpy(MAC_value, response + (i + 2), MAC_value_len);
             res = PM3_SUCCESS;
             break;
         }
+        // skip to next tag
+        i += 2 + response[i+1];
     }
     if (res != PM3_SUCCESS) {
         goto out;