github/RRG-Proxmark3
1
0
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2025-08-21 05:43:48 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix coverity ID 423236, 423235, 423234. Resource leak, use after free, out-of-bounds

Browse source
This commit is contained in:
iceman1001 2023-11-11 16:43:12 +01:00
commit 9ed6a3cb6c
1 changed files with 55 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

97
tools/mfkey/nested_util.c
View file

@ -196,53 +196,66 @@ uint64_t *nested(NtpKs1 *pNK, uint32_t sizePNK, uint32_t authuid, uint32_t *keyC
} }
free(threads); free(threads);
if (*keyCount != 0) { if (*keyCount == 0) {
keys = malloc((*keyCount) * sizeof(uint64_t)); printf("Didn't recover any keys.\r\n");
if (keys != NULL) { free(pRPs);
for (i = 0, j = 0; i < manyThread; i++) { return NULL;
if (pRPs[i].keyCount > 0) { }
// printf("The thread %d recover %d keys.\r\n", i, pRPs[i].keyCount);
if (pRPs[i].keys != NULL) {
memcpy(
keys + j,
pRPs[i].keys,
pRPs[i].keyCount * sizeof(uint64_t)
);
j += pRPs[i].keyCount;
free(pRPs[i].keys);
}
}
}
countKeys *ck = uniqsort(keys, *keyCount); keys = calloc((*keyCount) * sizeof(uint64_t), sizeof(uint8_t));
free(keys); if (keys == NULL) {
keys = (uint64_t *)NULL; printf("Cannot allocate memory to merge keys.\r\n");
*keyCount = 0; free(pRPs);
return NULL;
}
if (ck != NULL) { for (i = 0, j = 0; i < manyThread; i++) {
for (i = 0; i < TRY_KEYS; i++) { if (pRPs[i].keyCount > 0) {
// We don't known this key, try to break it // printf("The thread %d recover %d keys.\r\n", i, pRPs[i].keyCount);
// This key can be found here two or more times if (pRPs[i].keys != NULL) {
if (ck[i].count > 0) { memcpy(
*keyCount += 1; keys + j,
void *tmp = realloc(keys, sizeof(uint64_t) * (*keyCount)); pRPs[i].keys,
if (tmp != NULL) { pRPs[i].keyCount * sizeof(uint64_t)
keys = tmp; );
keys[*keyCount - 1] = ck[i].key; j += pRPs[i].keyCount;
} else { free(pRPs[i].keys);
printf("Cannot allocate memory for keys on merge.");
free(keys);
break;
}
}
}
} else {
printf("Cannot allocate memory for ck on uniqsort.");
} }
} else {
printf("Cannot allocate memory to merge keys.\r\n");
} }
} }
countKeys *ck = uniqsort(keys, *keyCount);
free(keys);
keys = (uint64_t *)NULL;
*keyCount = 0;
if (ck == NULL) {
printf("Cannot allocate memory for ck on uniqsort.");
free(ck);
free(pRPs);
return NULL;
}
for (i = 0; i < TRY_KEYS; i++) {
// We don't known this key, try to break it
// This key can be found here two or more times
if (ck[i].count > 0) {
*keyCount += 1;
void *tmp = realloc(keys, sizeof(uint64_t) * (*keyCount));
if (tmp == NULL) {
printf("Cannot allocate memory for keys on merge.");
free(ck);
free(keys);
free(pRPs);
return NULL;
}
keys = tmp;
keys[*keyCount - 1] = ck[i].key;
}
}
free(ck);
free(pRPs); free(pRPs);
return keys; return keys;
} }