dandri/proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2026-08-29 05:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3433 from munzzyy/fix/iclass-short-dump-oob

Browse Source 
Fix heap out-of-bounds reads on short iCLASS dump files
This commit is contained in:
Iceman
2026-08-19 02:04:21 +07:00
committed by GitHub
parent c8a20ab885 180bc14d31
commit 03ad480d4a
1 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/src/cmdhficlass.c
+24 -4
View File
@@ -1937,8 +1937,12 @@ static int CmdHFiClassELoad(const char *Cmd) {
}
if (verbose) {
print_picopass_header((picopass_hdr_t *) dump);
print_picopass_info((picopass_hdr_t *) dump);
if (bytes_read < sizeof(picopass_hdr_t)) {
PrintAndLogEx(FAILED, "Error, dump file is too small to be a valid iCLASS dump - bytes: %zu, expected at least: %zu", bytes_read, sizeof(picopass_hdr_t));
} else {
print_picopass_header((picopass_hdr_t *) dump);
print_picopass_info((picopass_hdr_t *) dump);
}
}
PrintAndLogEx(NORMAL, "");
@@ -2059,8 +2063,12 @@ static int CmdHFiClassEView(const char *Cmd) {
}
if (verbose) {
print_picopass_header((picopass_hdr_t *) dump);
print_picopass_info((picopass_hdr_t *) dump);
if (bytes < sizeof(picopass_hdr_t)) {
PrintAndLogEx(FAILED, "Error, only %u bytes downloaded, too small to be a valid iCLASS dump - expected at least: %zu", bytes, sizeof(picopass_hdr_t));
} else {
print_picopass_header((picopass_hdr_t *) dump);
print_picopass_info((picopass_hdr_t *) dump);
}
}
PrintAndLogEx(NORMAL, "");
@@ -2326,6 +2334,18 @@ static int CmdHFiClassDecrypt(const char *Cmd) {
return res;
}
// Below (and in iclass_decode_credentials()) we unconditionally probe
// fixed offsets up through block 9 -- app_issuer_area (block 5), the
// aa1_encryption flag and block 7 in iclass_decode_credentials(), and
// the block 9 PACS/PIN check here -- regardless of what applimit or
// decryptedlen/8 say the "real" block count is. All 10 blocks (0-9)
// must actually be present in the loaded file before any of that runs.
if (decryptedlen < 10 * PICOPASS_BLOCK_SIZE) {
PrintAndLogEx(FAILED, "Error, dump file is too small - bytes: %zu, expected at least: %d", decryptedlen, 10 * PICOPASS_BLOCK_SIZE);
free(decrypted);
return PM3_EFILE;
}
have_file = true;
}