additional memory leaks, overflow and unchecked ...

return values fixed

thanks to iceman1001
This commit is contained in:
marshmellow42 2016-02-14 13:24:03 -05:00
commit 8ea5706047
2 changed files with 15 additions and 7 deletions

View file

@ -875,6 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
break; break;
default: default:
PrintAndLog("Key type must be A , B or ?"); PrintAndLog("Key type must be A , B or ?");
free(keyBlock);
return 1; return 1;
}; };
@ -926,6 +927,7 @@ int CmdHF14AMfChk(const char *Cmd)
if (!p) { if (!p) {
PrintAndLog("Cannot allocate memory for defKeys"); PrintAndLog("Cannot allocate memory for defKeys");
free(keyBlock); free(keyBlock);
fclose(f);
return 2; return 2;
} }
keyBlock = p; keyBlock = p;
@ -1219,7 +1221,7 @@ int CmdHF14AMfELoad(const char *Cmd)
if (numblk2 > 0) numBlocks = numblk2; if (numblk2 > 0) numBlocks = numblk2;
len = param_getstr(Cmd,nameParamNo,filename); len = param_getstr(Cmd,nameParamNo,filename);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
fnameptr += len; fnameptr += len;
@ -1316,7 +1318,7 @@ int CmdHF14AMfESave(const char *Cmd)
len = param_getstr(Cmd,nameParamNo,filename); len = param_getstr(Cmd,nameParamNo,filename);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
// user supplied filename? // user supplied filename?
if (len < 1) { if (len < 1) {
@ -1593,7 +1595,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
return 0; return 0;
} else { } else {
len = strlen(Cmd); len = strlen(Cmd);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
memcpy(filename, Cmd, len); memcpy(filename, Cmd, len);
fnameptr += len; fnameptr += len;
@ -1762,7 +1764,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
return 0; return 0;
} else { } else {
len = strlen(Cmd); len = strlen(Cmd);
if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4; if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;
// get filename based on UID // get filename based on UID
if (len < 1) { if (len < 1) {
@ -1906,6 +1908,11 @@ int CmdHF14AMfSniff(const char *Cmd){
bufsize = traceLen; bufsize = traceLen;
memset(buf, 0x00, traceLen); memset(buf, 0x00, traceLen);
} }
if (bufPtr == NULL) {
PrintAndLog("Cannot allocate memory for trace");
free(buf);
return 2;
}
memcpy(bufPtr, resp.d.asBytes, len); memcpy(bufPtr, resp.d.asBytes, len);
bufPtr += len; bufPtr += len;
pckNum++; pckNum++;

View file

@ -23,7 +23,7 @@ int ukbhit(void)
static struct termios Otty, Ntty; static struct termios Otty, Ntty;
tcgetattr( 0, &Otty); if ( tcgetattr( 0, &Otty) == -1 ) return -1;
Ntty = Otty; Ntty = Otty;
Ntty.c_iflag = 0; /* input mode */ Ntty.c_iflag = 0; /* input mode */
@ -140,8 +140,9 @@ char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t brea
size_t in_index = 0; size_t in_index = 0;
// loop through the out_index to make sure we don't go too far // loop through the out_index to make sure we don't go too far
for (size_t out_index=0; out_index < max_len; out_index++) { for (size_t out_index=0; out_index < max_len; out_index++) {
// set character // set character - (should be binary but verify it isn't more than 1 digit)
sprintf(tmp++, "%u", data[in_index]); if (data[in_index]<10)
sprintf(tmp++, "%u", data[in_index]);
// check if a line break is needed and we have room to print it in our array // check if a line break is needed and we have room to print it in our array
if ( (breaks > 0) && !((in_index+1) % breaks) && (out_index+1 != max_len) ) { if ( (breaks > 0) && !((in_index+1) % breaks) && (out_index+1 != max_len) ) {
// increment and print line break // increment and print line break