Merge pull request #3555 from munzzyy/fix/xerox-view-info-block-oob

Fix heap out-of-bounds read in hf xerox view on short dump files

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Fixed `hf xerox view` - now rejects a dump file too small to contain the info blocks instead of reading past it (@munzzyy)
 - Changed NG frame layout to align better with 64bytes frames. From 512 -> 624bytes (@iceman1001)
 - Changed `hf plot` - converted to NG frame (@iceman1001)
 - Fixed `hf mfu cchk` - now 3-pass key check all keys sent to device  (@iceman1001)

client/src/cmdhfxerox.c

@@ -952,6 +952,19 @@ static int CmdHFXeroxView(const char *Cmd) {
         return res;
     }
 
+    uint8_t info_max_block = 0;
+    for (uint8_t i = 0; i < ARRAYLEN(info_blocks); i++) {
+        if (info_blocks[i] > info_max_block) {
+            info_max_block = info_blocks[i];
+        }
+    }
+    size_t info_min = (info_max_block + 1) * XEROX_BLOCK_SIZE;
+    if (bytes_read < info_min) {
+        PrintAndLogEx(FAILED, "Error, dump file is too small to be a valid Xerox dump - bytes: %zu, expected at least: %zu", bytes_read, info_min);
+        free(dump);
+        return PM3_EFILE;
+    }
+
     uint16_t blockno = bytes_read / XEROX_BLOCK_SIZE;
 
     if (verbose) {