From b3f2a18ec4d6e745e836ffd218f314ad4b53b847 Mon Sep 17 00:00:00 2001
From: merlokk <807634+merlokk@users.noreply.github.com>
Date: Fri, 24 Dec 2021 19:14:48 +0200
Subject: [PATCH] top level read command dynamic memory allocation

---
 client/src/cmdhfmfdes.c         | 13 ++++++++++++-
 client/src/mifare/desfirecore.c | 19 +++++++++++++++----
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/client/src/cmdhfmfdes.c b/client/src/cmdhfmfdes.c
index 9ba244a3e..c8b165dda 100644
--- a/client/src/cmdhfmfdes.c
+++ b/client/src/cmdhfmfdes.c
@@ -4615,7 +4615,12 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
 
     PrintAndLogEx(INFO, "------------------------------- " _CYAN_("File %02x data") " -------------------------------", fnum);
 
-    uint8_t resp[2048] = {0};
+    uint8_t *resp  = calloc(DESFIRE_BUFFER_SIZE, 1);
+    if (resp == NULL) {
+        PrintAndLogEx(ERR, "Desfire calloc " _RED_("error"));
+        DropField();
+        return PM3_EMALLOC;
+    }
     size_t resplen = 0;
 
     if (filetype == RFTData) {
@@ -4623,6 +4628,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
         if (res != PM3_SUCCESS) {
             PrintAndLogEx(ERR, "Desfire ReadFile command " _RED_("error") ". Result: %d", res);
             DropField();
+            free(resp);
             return PM3_ESOFT;
         }
 
@@ -4640,6 +4646,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
         if (res != PM3_SUCCESS) {
             PrintAndLogEx(ERR, "Desfire GetValue operation " _RED_("error") ". Result: %d", res);
             DropField();
+            free(resp);
             return PM3_ESOFT;
         }
         PrintAndLogEx(SUCCESS, "Read file 0x%02x value: %d (0x%08x)", fnum, value, value);
@@ -4652,6 +4659,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
             if (res != PM3_SUCCESS) {
                 PrintAndLogEx(ERR, "Desfire ReadRecords (len=1) command " _RED_("error") ". Result: %d", res);
                 DropField();
+                free(resp);
                 return PM3_ESOFT;
             }
             reclen = resplen;
@@ -4666,6 +4674,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
             if (res != PM3_SUCCESS) {
                 PrintAndLogEx(ERR, "Desfire ReadRecords command " _RED_("error") ". Result: %d", res);
                 DropField();
+                free(resp);
                 return PM3_ESOFT;
             }
         }
@@ -4690,6 +4699,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
         if (res != PM3_SUCCESS) {
             PrintAndLogEx(ERR, "Desfire ReadFile command " _RED_("error") ". Result: %d", res);
             DropField();
+            free(resp);
             return PM3_ESOFT;
         }
 
@@ -4717,6 +4727,7 @@ static int DesfileReadFileAndPrint(DesfireContext_t *dctx, uint8_t fnum, int fil
         }
     }
 
+    free(resp);
     return PM3_SUCCESS;
 }
 
diff --git a/client/src/mifare/desfirecore.c b/client/src/mifare/desfirecore.c
index 844b92223..8c67242fe 100644
--- a/client/src/mifare/desfirecore.c
+++ b/client/src/mifare/desfirecore.c
@@ -1861,20 +1861,31 @@ static int DesfireCommandEx(DesfireContext_t *dctx, uint8_t cmd, uint8_t *data,
         *resplen = 0;
 
     uint8_t respcode = 0xff;
-    uint8_t xresp[2050] = {0};
+    uint8_t *xresp  = calloc(DESFIRE_BUFFER_SIZE, 1);
+    if (xresp == NULL)
+        return PM3_EMALLOC;
+
     size_t xresplen = 0;
     int res = DesfireExchangeEx(false, dctx, cmd, data, datalen, &respcode, xresp, &xresplen, true, splitbysize);
-    if (res != PM3_SUCCESS)
+    if (res != PM3_SUCCESS) {
+        free(xresp);
         return res;
-    if (respcode != MFDES_S_OPERATION_OK)
+    }
+    if (respcode != MFDES_S_OPERATION_OK) {
+        free(xresp);
         return PM3_EAPDU_FAIL;
-    if (checklength >= 0 && xresplen != checklength)
+    }
+    if (checklength >= 0 && xresplen != checklength) {
+        free(xresp);
         return PM3_EAPDU_FAIL;
+    }
 
     if (resplen)
         *resplen = xresplen;
     if (resp)
         memcpy(resp, xresp, (splitbysize == 0) ? xresplen : xresplen * splitbysize);
+
+    free(xresp);
     return PM3_SUCCESS;
 }