mirror of
https://github.com/DarkFlippers/unleashed-firmware.git
synced 2026-08-25 16:19:46 +00:00
2631895419
* [NFC] Bound file-controlled lengths in the EMV .nfc loader emv_load() used lengths straight from the file as write sizes into fixed-size fields of a heap-allocated EmvApplication: three unbounded strcpy()s from file strings, and PAN length/AID length read as uint32_t then passed to flipper_format_read_hex() with no bound against pan[10] and aid[16]. Opening a crafted .nfc corrupted the heap, and an oversized pan_len also walked the render loops past the array. The three read_string() results were discarded too, so a failed read left the scratch FuriString holding the previous key's value for the next strcpy(). Only reachable when a key is absent, which fails the load anyway - but it fed the overflow above. Bound every copy by its destination. Strings truncate: they are cosmetic, and emv_save() writes the keys even for a card with no such tag, so a nameless card must still load. Lengths reject: the AID goes out verbatim in the SELECT APDU and both lengths bound render loops, so a truncated value is worse than a failed load. Lengths are committed only once their bytes are read. Also in emv_save(), which had the same file-field-width mismatch in the write direction: PIN try counter dereferenced a uint8_t field through a uint32_t*, writing three neighbouring bytes into the file. Plus an unused FuriString allocation. Closes #1055 * upd changelog [ci skip] --------- Co-authored-by: MX <10697207+xMasterX@users.noreply.github.com>