ifdnfc icon indicating copy to clipboard operation
ifdnfc copied to clipboard

Fix buffer overflows in ifdnfc-activate.c

Open mikma opened this issue 1 year ago • 0 comments

It fixes the following issue with pbRecvBuffer and also expands pbSendBuffer to allow for both bytes of the uint16_t length field.

In function 'memcpy',
    inlined from 'main' at ifdnfc-activate.c:189:7:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:29:10:
    warning: '__builtin_memcpy' reading 2 bytes from a region of size 0 [-Wstringop-overread]
   29 |   return __builtin___memcpy_chk (__dest, __src, __len,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   30 |                                  __glibc_objsize0 (__dest));
      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
ifdnfc-activate.c: In function 'main':
ifdnfc-activate.c:45:8: note: at offset 1 into source object 'pbRecvBuffer' of size 1
   45 |   BYTE pbRecvBuffer[1];
      |        ^~~~~~~~~~~~

The issue was mentioned in https://github.com/nfc-tools/ifdnfc/issues/9#issuecomment-1462738813 a couple of years ago but hasn't been fixed in the repository.

mikma avatar Apr 23 '25 20:04 mikma