github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-22 14:23:50 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #1933 from DidierA/desfire_info_check

Browse source 
Desfire : check length of tag answers
This commit is contained in:
Iceman 2023-03-04 10:10:07 +01:00 • committed by GitHub
commit 75233d0aec
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
armsrc/mifaredesfire.c
View file

@ -182,6 +182,12 @@ void MifareDesfireGetInformation(void) {
return; return;
} }
if (len < sizeof(payload.versionHW)+1) {
Dbprintf("Tag answer to MFDES_GET_VERSION was too short: data in Hardware Information is probably invalid.");
print_result("Answer", resp, len);
memset(resp+len, 0xFF, sizeof(payload.versionHW)+1 - len); // clear remaining bytes
}
memcpy(payload.versionHW, resp + 1, sizeof(payload.versionHW)); memcpy(payload.versionHW, resp + 1, sizeof(payload.versionHW));
// ADDITION_FRAME 1 // ADDITION_FRAME 1
@ -194,6 +200,13 @@ void MifareDesfireGetInformation(void) {
switch_off(); switch_off();
return; return;
} }
if (len < sizeof(payload.versionSW)+1) {
Dbprintf("Tag answer to MFDES_ADDITIONAL_FRAME 1 was too short: data in Software Information is probably invalid.");
print_result("Answer", resp, len);
memset(resp+len, 0xFF, sizeof(payload.versionSW)+1 - len); // clear remaining bytes
}
memcpy(payload.versionSW, resp + 1, sizeof(payload.versionSW)); memcpy(payload.versionSW, resp + 1, sizeof(payload.versionSW));
// ADDITION_FRAME 2 // ADDITION_FRAME 2
@ -206,6 +219,12 @@ void MifareDesfireGetInformation(void) {
return; return;
} }
if (len < sizeof(payload.details)+1) {
Dbprintf("Tag answer to MFDES_ADDITIONAL_FRAME 2 was too short: data in Batch number and Production date is probably invalid");
print_result("Answer", resp, len);
memset(resp+len, 0xFF, sizeof(payload.details)+1 - len); // clear remaining bytes
}
memcpy(payload.details, resp + 1, sizeof(payload.details)); memcpy(payload.details, resp + 1, sizeof(payload.details));
LED_B_ON(); LED_B_ON();