usb: ccid: check ccid apdu length

[Qemu-devel] [PATCH] usb: ccid: check ccid apdu length

P J P posted 1 patch 7 years, 2 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20170202192228.10847-1-ppandit@redhat.com

Test checkpatch passed

Test docker passed

Test s390x failed

hw/usb/dev-smartcard-reader.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[Qemu-devel] [PATCH] usb: ccid: check ccid apdu length

Posted by P J P 7 years, 2 months ago

From: Prasad J Pandit <pjp@fedoraproject.org>

CCID device emulator uses Application Protocol Data Units(APDU)
to exchange command and responses to and from the host.
The length in these units couldn't be greater than 65536. Add
check to ensure the same. It'd also avoid potential integer
overflow in emulated_apdu_from_guest.

Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/usb/dev-smartcard-reader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 89e11b6..1325ea1 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -967,7 +967,7 @@ static void ccid_on_apdu_from_guest(USBCCIDState *s, CCID_XferBlock *recv)
     DPRINTF(s, 1, "%s: seq %d, len %d\n", __func__,
                 recv->hdr.bSeq, len);
     ccid_add_pending_answer(s, (CCID_Header *)recv);
-    if (s->card) {
+    if (s->card && len <= BULK_OUT_DATA_SIZE) {
         ccid_card_apdu_from_guest(s->card, recv->abData, len);
     } else {
         DPRINTF(s, D_WARN, "warning: discarded apdu\n");
-- 
2.9.3

Re: [Qemu-devel] [PATCH] usb: ccid: check ccid apdu length

Posted by Gerd Hoffmann 7 years, 2 months ago

On Fr, 2017-02-03 at 00:52 +0530, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
> 
> CCID device emulator uses Application Protocol Data Units(APDU)
> to exchange command and responses to and from the host.
> The length in these units couldn't be greater than 65536. Add
> check to ensure the same. It'd also avoid potential integer
> overflow in emulated_apdu_from_guest.
> 
> Reported-by: Li Qiang <liqiang6-s@360.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>

Added to usb queue.

thanks,
  Gerd