hf mf dump, does a guess the key file name, and if you ran for instance a autopwn against a 4K card but didnt mention it , it defaults to 1K. Meaning the recovered keyfile will have 32 keys. When trying to dump card and specifiy 4K, it would automatically find that keyfile and happily go out-of-bounds leading to client crash

CHANGELOG.md

@@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file.
 This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log...
 
 ## [unreleased][unreleased]
+- Fix `hf mf dump` - added a check for keyfile to contain enough keys for card (@iceman1001)
 - Fix `hf mf eview` - now viewing 2k, 4k cards doesn't get wrong background color (@iceman1001)
 - Changed `hf mf info` - skip checking if it detects a MIFARE Ultralight family card (@iceman1001)
 - Changed `hf mf rdsc` - it now addeds the used key to the output in the sector trailer (@iceman1001)

client/src/cmdhfmf.c

@@ -876,20 +876,25 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
     char *fptr = NULL;
     if (keyfn == NULL || keyfn[0] == '\0') {
         fptr = GenerateFilename("hf-mf-", "-key.bin");
-        if (fptr == NULL)
+        if (fptr == NULL) {
             return PM3_ESOFT;
+        }
 
         keyfn = fptr ;
     }
 
-    PrintAndLogEx(INFO, "Using... %s", keyfn);
-
     size_t alen = 0, blen = 0;
-    uint8_t *keyA, *keyB;
+    uint8_t *keyA = NULL, *keyB = NULL;
     if (loadFileBinaryKey(keyfn, "", (void **)&keyA, (void **)&keyB, &alen, &blen) != PM3_SUCCESS) {
         free(fptr);
         return PM3_ESOFT;
     }
+    free(fptr);
+
+    if ((alen < (numSectors * MIFARE_KEY_SIZE)) || (blen < (numSectors * MIFARE_KEY_SIZE))) {
+        PrintAndLogEx(WARNING, "Key file is too small for selected card type");
+        return PM3_ELENGTH;
+    }
 
     PrintAndLogEx(INFO, "Reading sector access bits...");
     PrintAndLogEx(INFO, "." NOLF);
@@ -898,15 +903,17 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
 
     mf_readblock_t payload;
     uint8_t current_key;
+
     for (uint8_t sectorNo = 0; sectorNo < numSectors; sectorNo++) {
+
         current_key = MF_KEY_A;
+
         for (uint8_t tries = 0; tries < MIFARE_SECTOR_RETRY; tries++) {
             PrintAndLogEx(NORMAL, "." NOLF);
             fflush(stdout);
 
             if (kbd_enter_pressed()) {
                 PrintAndLogEx(WARNING, "\naborted via keyboard!\n");
-                free(fptr);
                 free(keyA);
                 free(keyB);
                 return PM3_EOPABORTED;
@@ -951,7 +958,9 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
     PrintAndLogEx(INFO, "Dumping all blocks from card...");
 
     for (uint8_t sectorNo = 0; sectorNo < numSectors; sectorNo++) {
+
         for (uint8_t blockNo = 0; blockNo < mfNumBlocksPerSector(sectorNo); blockNo++) {
+
             bool received = false;
             current_key = MF_KEY_A;
             uint8_t data_area = (sectorNo < 32) ? blockNo : blockNo / 5;
@@ -972,6 +981,7 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
                     clearCommandBuffer();
                     SendCommandNG(CMD_HF_MIFARE_READBL, (uint8_t *)&payload, sizeof(mf_readblock_t));
                     received = WaitForResponseTimeout(CMD_HF_MIFARE_READBL, &resp, 1500);
+
                 } else {
                     // data block. Check if it can be read with key A or key B
                     if ((rights[sectorNo][data_area] == 0x03) || (rights[sectorNo][data_area] == 0x05)) {
@@ -983,6 +993,7 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
                         clearCommandBuffer();
                         SendCommandNG(CMD_HF_MIFARE_READBL, (uint8_t *)&payload, sizeof(mf_readblock_t));
                         received = WaitForResponseTimeout(CMD_HF_MIFARE_READBL, &resp, 1500);
+
                     } else {
                         // key A would work
                         payload.blockno = mfFirstBlockOfSector(sectorNo) + blockNo;
@@ -1033,7 +1044,7 @@ static int mfc_read_tag(iso14a_card_select_t *card, uint8_t *carddata, uint8_t n
         }
     }
 
-    free(fptr);
+
     free(keyA);
     free(keyB);
 

doc/commands.json

@@ -13376,6 +13376,6 @@
     "metadata": {
         "commands_extracted": 768,
         "extracted_by": "PM3Help2JSON v1.00",
-        "extracted_on": "2025-06-08T14:05:43"
+        "extracted_on": "2025-06-08T17:26:24"
     }
 }