iasecc: Avoid another buffer overflow

thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63949
llogar · Nov 8, 2023 · 8fc2c20 · 8fc2c20
1 parent d9a7353
commit 8fc2c20
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/src/libopensc/iasecc-sdo.c b/src/libopensc/iasecc-sdo.c
@@ -44,7 +44,8 @@ iasecc_parse_acls(struct sc_card *card, struct iasecc_sdo_docp *docp, int flags)
 {
 	struct sc_context *ctx = card->ctx;
 	struct iasecc_extended_tlv *acls = &docp->acls_contact;
-	int ii, offs;
+	int ii;
+	size_t offs;
 	unsigned char mask = 0x40;
 
 	if (flags)
@@ -56,8 +57,12 @@ iasecc_parse_acls(struct sc_card *card, struct iasecc_sdo_docp *docp, int flags)
 	docp->amb = *(acls->value + 0);
 	memset(docp->scbs, 0xFF, sizeof(docp->scbs));
 	for (ii=0, offs = 1; ii<7; ii++, mask >>= 1)
-		if (mask & docp->amb)
+		if (mask & docp->amb) {
+			if (offs >= acls->size) {
+				LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_DATA);
+			}
 			docp->scbs[ii] = *(acls->value + offs++);
+		}
 
 	sc_log(ctx, "iasecc_parse_docp() SCBs %02X:%02X:%02X:%02X:%02X:%02X:%02X",
 			docp->scbs[0],docp->scbs[1],docp->scbs[2],docp->scbs[3],