crewID/libfreefare
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix invalid memory access in CRC8 computation functions.

Browse source
This commit is contained in:
Romain Tartiere 2010-01-09 02:55:42 +00:00
parent 1c62fc83e6
commit d8b0a18752
1 changed files with 15 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
libfreefare/mad.c
View file

@ -188,11 +188,15 @@ mad_read (MifareClassicTag tag)
/* Read MAD data at 0x00 (MAD1, MAD2) */ /* Read MAD data at 0x00 (MAD1, MAD2) */
if (mifare_classic_read (tag, 0x01, &data) < 0) if (mifare_classic_read (tag, 0x01, &data) < 0)
goto error; goto error;
memcpy (&(mad->sector_0x00), data, sizeof (data));
uint8_t *p = (uint8_t *) &(mad->sector_0x00);
memcpy (p, data, sizeof (data));
p+= sizeof (data);
if (mifare_classic_read (tag, 0x02, &data) < 0) if (mifare_classic_read (tag, 0x02, &data) < 0)
goto error; goto error;
memcpy (&(mad->sector_0x00) + sizeof (data), data, sizeof (data)); memcpy (p, data, sizeof (data));
uint8_t crc = mad->sector_0x00.crc; uint8_t crc = mad->sector_0x00.crc;
uint8_t computed_crc = sector_0x00_crc8 (mad); uint8_t computed_crc = sector_0x00_crc8 (mad);
@ -207,17 +211,23 @@ mad_read (MifareClassicTag tag)
goto error; goto error;
} }
p = (uint8_t *) &(mad->sector_0x10);
if (mifare_classic_read (tag, 0x40, &data) < 0) if (mifare_classic_read (tag, 0x40, &data) < 0)
goto error; goto error;
memcpy (&(mad->sector_0x10), data, sizeof (data)); memcpy (p, data, sizeof (data));
p += sizeof (data);
if (mifare_classic_read (tag, 0x41, &data) < 0) if (mifare_classic_read (tag, 0x41, &data) < 0)
goto error; goto error;
memcpy (&(mad->sector_0x10) + sizeof (data), data, sizeof (data)); memcpy (p, data, sizeof (data));
p += sizeof (data);
if (mifare_classic_read (tag, 0x42, &data) < 0) if (mifare_classic_read (tag, 0x42, &data) < 0)
goto error; goto error;
memcpy (&(mad->sector_0x10) + sizeof (data) * 2, data, sizeof (data)); memcpy (p, data, sizeof (data));
crc = mad->sector_0x10.crc; crc = mad->sector_0x10.crc;
computed_crc = sector_0x10_crc8 (mad); computed_crc = sector_0x10_crc8 (mad);