From 033a734ceb54b45a23965a46642ae34a0f57c3ff Mon Sep 17 00:00:00 2001 From: achazal Date: Tue, 24 Mar 2026 10:49:59 +0100 Subject: [PATCH 1/2] fix(pcsc): remove infinite loop and buffer overflow in `smart pcsc` --- client/src/cmdsmartcard.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c index 5d01f9a9d..6af48d90c 100644 --- a/client/src/cmdsmartcard.c +++ b/client/src/cmdsmartcard.c @@ -1312,7 +1312,7 @@ static int CmdPCSC(const char *Cmd) { } } - uint8_t res[22] = {0}; + uint8_t res[2 + 256] = {0}; res[1] = atrLen; memcpy(res + 2, atr, atrLen); mbedtls_net_send(&netCtx, res, 2 + atrLen); @@ -1393,7 +1393,7 @@ static int CmdPCSC(const char *Cmd) { // ISO 15. - if (use_contact && IfPm3Iso14443() && smart_select(false, &card) == PM3_SUCCESS) { + if (use_contact && IfPm3Iso14443() && smart_select(false, &card)) { have_card = true; card_type = CC_CONTACT; } From 232bb1959c807632e1ed04216a0203c963c3fd22 Mon Sep 17 00:00:00 2001 From: achazal Date: Tue, 24 Mar 2026 14:21:00 +0100 Subject: [PATCH 2/2] fix(pcsc): add comment explaining the use of a 256 bytes buffer --- client/src/cmdsmartcard.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/client/src/cmdsmartcard.c b/client/src/cmdsmartcard.c index 6af48d90c..8d3586732 100644 --- a/client/src/cmdsmartcard.c +++ b/client/src/cmdsmartcard.c @@ -1312,6 +1312,8 @@ static int CmdPCSC(const char *Cmd) { } } + // ISO 7816-3 specifies that ATRs can be 2 to 33 bytes long + // but some custom cards may support up to 256 bytes long ATRs uint8_t res[2 + 256] = {0}; res[1] = atrLen; memcpy(res + 2, atr, atrLen);