[Opensc-commits] [OpenSC/OpenSC] 06a552: asn1: fix uninitialized pointer free on empty objects

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

  Branch: refs/heads/master
  Home:   https://github.com/OpenSC/OpenSC
  Commit: 06a552abb6323f3f1fb8a23a61710fb0737be76d
      https://github.com/OpenSC/OpenSC/commit/06a552abb6323f3f1fb8a23a61710fb0737be76d
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/asn1.c

  Log Message:
  -----------
  asn1: fix uninitialized pointer free on empty objects

When decoding an empty ASN.1 object (objlen == 0) with SC_ASN1_ALLOC,
the memory allocation was skipped but the buffer pointer was left
uninitialized. If a subsequent decoding error occurred in the sequence,
`sc_free_entry` would attempt to free this uninitialized pointer. This
commit ensures the pointer is explicitly set to NULL when allocation is
skipped.

Fixes oss-fuzz issue 540464822: https://issues.oss-fuzz.com/issues/540464822

  Commit: 9540882c66ab4a1d71e2fd6b14e2857974e78165
      https://github.com/OpenSC/OpenSC/commit/9540882c66ab4a1d71e2fd6b14e2857974e78165
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tests/fuzzing/fuzz_piv_tool.c
    M src/tests/fuzzing/fuzz_pkcs15_tool.c

  Log Message:
  -----------
  fuzzing: reset tool global static variables to prevent integer overflows

Variables such as `verbose` and `opt_wait` in `piv-tool.c` and
`pkcs15-tool.c` are updated by `getopt_long` during `_main` execution.
The fuzzer harnesses run `_main` repetitively but failed to reset these
static counters across iterations. Over thousands of iterations, this
continuous incrementing triggered a signed integer overflow caught by
UBSAN.

Fixes OSS-Fuzz Integer-overflow in _main (fuzz_pkcs15_tool.c / piv_tool.c).
Ref: https://oss-fuzz.com/testcase-detail/4520649801138176

  Commit: a5e1f04445275b86a12df3d2760f67b04257ca66
      https://github.com/OpenSC/OpenSC/commit/a5e1f04445275b86a12df3d2760f67b04257ca66
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tests/fuzzing/fuzz_pkcs15init.c

  Log Message:
  -----------
  fuzz: Fix OOB read in fuzz_pkcs15init do_store_data_object

Bound the memcpy length by the dynamically allocated size of `buf`
to prevent heap out-of-bounds reads when the fuzzer provides a
testcase smaller than SC_MAX_OBJECT_ID_OCTETS (16 bytes).

Fixes OSS-Fuzz issue: https://issues.oss-fuzz.com/issues/42537774

  Commit: 59846e1f4acc3d31be48cb4ad55df2a92302bfe2
      https://github.com/OpenSC/OpenSC/commit/59846e1f4acc3d31be48cb4ad55df2a92302bfe2
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tests/fuzzing/fuzz_pkcs15init.c

  Log Message:
  -----------
  fuzz: Fix OOB read in fuzz_pkcs15init do_store_secret_key

Bound memcpy length by the dynamically allocated size of `buf`
to prevent heap out-of-bounds reads when testcase is small.

Fixes OSS-Fuzz issue: https://issues.oss-fuzz.com/issues/42537774

  Commit: a3a14a3cd3c2f8f653cb2034d3818628aa862225
      https://github.com/OpenSC/OpenSC/commit/a3a14a3cd3c2f8f653cb2034d3818628aa862225
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tests/fuzzing/fuzz_asn1_sig_value.c

  Log Message:
  -----------
  fuzz: Fix missing realloc failure checks in fuzz_asn1_sig_value

Bail out of the fuzzer harness cleanly if memory allocation
limits are reached, preventing out-of-bounds memcpy into
stale buffers.

  Commit: eef5efd9e41b61514c0795d94922895a2f6ffdb3
      https://github.com/OpenSC/OpenSC/commit/eef5efd9e41b61514c0795d94922895a2f6ffdb3
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-coolkey.c

  Log Message:
  -----------
  coolkey: Fix integer overflow parsing combined object

Coverity detected an out-of-bounds read in coolkey_process_combined_object
(CID 353967).

This occurred because `object_offset` was declared as a 16-bit `unsigned short`.
If the uncompressed object exceeded 64KB, incrementing the offset caused a
wrap-around. When this wrapped value was used in the bounds check, the addition
failed to trigger an error, allowing the parser to read incorrect offsets and
potentially overrun the buffer.

Changing `object_offset` to `size_t` prevents the wrap-around and safely
evaluates the bounds check.

  Commit: 5d735fad3a45858e061d1b4798749607711947fb
      https://github.com/OpenSC/OpenSC/commit/5d735fad3a45858e061d1b4798749607711947fb
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/pkcs15init/pkcs15-lib.c

  Log Message:
  -----------
  pkcs15init: Fix integer underflow in loop update clause

Fixes Coverity CID 427417 where unconditionally subtracting 2 from
tmp_path.len (size_t) in a for-loop could wrap around to a huge
positive number.

  Commit: 31cb022a7bc7a2543aba1519a074a901559b0cda
      https://github.com/OpenSC/OpenSC/commit/31cb022a7bc7a2543aba1519a074a901559b0cda
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/pkcs15-syn.c

  Log Message:
  -----------
  pkcs15: explicitly transfer buffer ownership

Fixes Coverity CID 454822. Explicitly sets `cert_info.value.value = NULL`
upon successfully adding the object to appease static analysis, clarifying
that ownership was transferred to OpenSC.

  Commit: 7155eef41f4723d232cd8e8d4b883b39f33fce14
      https://github.com/OpenSC/OpenSC/commit/7155eef41f4723d232cd8e8d4b883b39f33fce14
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-npa.c

  Log Message:
  -----------
  card-npa: Fix potential NULL pointer dereferences in npa_pace_verify

Fixes Coverity CIDs 503710 and 503711. The `pin` pointer could potentially
be NULL (as indicated by existing null checks), but it was unconditionally
dereferenced when setting or checking `pin->tries_left`.

This safely wraps the remaining dereferences in `if (pin)` checks.

  Commit: 1d35457550d36d3d7a596fd91f894f7df61fbb79
      https://github.com/OpenSC/OpenSC/commit/1d35457550d36d3d7a596fd91f894f7df61fbb79
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M AGENTS.md

  Log Message:
  -----------
  AGENTS.md: force short commit messages

  Commit: c3db3361ea5d2be66057701817b959a935227523
      https://github.com/OpenSC/OpenSC/commit/c3db3361ea5d2be66057701817b959a935227523
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-openpgp.c

  Log Message:
  -----------
  card-openpgp: Fix false positive resource leak warning

Fixes Coverity CID 415761. Adds an explicit `priv->mf != NULL` check
in `populate_blobs_to_mf` to assure static analysis that the allocated
blob is safely linked to the parent tree and not leaked.

  Commit: c9060d3522f28d555f58864230bd0262b84e7754
      https://github.com/OpenSC/OpenSC/commit/c9060d3522f28d555f58864230bd0262b84e7754
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tools/opensc-tool.c

  Log Message:
  -----------
  opensc-tool: Fix uninitialized memory warning

Fixes Coverity CID 281420. Scopes the printing of the buffer strictly inside
the `sc_lock` success block to guarantee that `buf` is fully initialized.

  Commit: 687dd7e64bfacddaf22c2fb38581d3461a210496
      https://github.com/OpenSC/OpenSC/commit/687dd7e64bfacddaf22c2fb38581d3461a210496
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/pkcs11/pkcs11-spy.c

  Log Message:
  -----------
  pkcs11-spy: Fix SIZEOF_MISMATCH Coverity false positive

Fixes Coverity CID 500043. Assigns the `malloc` result to a pointer of the
correctly sized type before casting to the base struct pointer, satisfying
static analysis checks on allocation sizes.

  Commit: 8927b015bf357d9a2852a624159f8b3dba1c57bf
      https://github.com/OpenSC/OpenSC/commit/8927b015bf357d9a2852a624159f8b3dba1c57bf
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-piv.c

  Log Message:
  -----------
  card-piv: Fix potential integer underflow warning

Fixes Coverity CID 468028. Separates the assignment of `sbuflen` from the
`sc_asn1_put_tag` call to ensure the negative error code is checked before
it gets implicitly cast to `size_t`.

  Commit: 7333555551f25ff8d5abdada138ad5f817bba69e
      https://github.com/OpenSC/OpenSC/commit/7333555551f25ff8d5abdada138ad5f817bba69e
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-cac.c

  Log Message:
  -----------
  Fix Coverity CID 302914

Add a bounds check for the AID length in `cac_parse_aid` to prevent
using an untrusted scalar for memory allocation and to avoid overflowing
`sc_path_t.aid.value`.

  Commit: f9bbaf0c3e9592db7ca54d7d40d4877492339546
      https://github.com/OpenSC/OpenSC/commit/f9bbaf0c3e9592db7ca54d7d40d4877492339546
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-coolkey.c

  Log Message:
  -----------
  Fix Coverity CID 147705

Add a bounds check for `object_count` before iterating over combined objects to prevent an untrusted loop bound (TAINTED_SCALAR) warning.

  Commit: d378f017796dec67da2bd7ed65bc4e7bcc0b0ae4
      https://github.com/OpenSC/OpenSC/commit/d378f017796dec67da2bd7ed65bc4e7bcc0b0ae4
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/log.c

  Log Message:
  -----------
  Fix Coverity CID 141875

Limit the memory allocation in `_sc_debug_hex` to
`SC_MAX_EXT_APDU_BUFFER_SIZE`. This prevents untrusted, excessively
large lengths (TAINTED_SCALAR) from causing an out-of-memory error when
generating hex dumps.

  Commit: 09d67245cdd64e9a2a1e78cf8134cb7dbc53cf6b
      https://github.com/OpenSC/OpenSC/commit/09d67245cdd64e9a2a1e78cf8134cb7dbc53cf6b
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/card-cac.c

  Log Message:
  -----------
  Fix Coverity CID 141875

Add a length bounds check in `cac_parse_cuid`. This prevents an
untrusted value (TAINTED_SCALAR) from causing an out-of-memory error.

  Commit: 5d2a1ebd7072dad9dd8e4269b204f7651cc30677
      https://github.com/OpenSC/OpenSC/commit/5d2a1ebd7072dad9dd8e4269b204f7651cc30677
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/pkcs15-sc-hsm.c

  Log Message:
  -----------
  Fix Coverity CID 28042

Check the return value of `sc_pkcs15_fix_ec_parameters` in `sc_pkcs15emu_sc_hsm_get_ec_public_key` and debug on error.

  Commit: 06f8525ee2087c0f5a2b4a19b3658c4ca1f3cd60
      https://github.com/OpenSC/OpenSC/commit/06f8525ee2087c0f5a2b4a19b3658c4ca1f3cd60
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/pkcs11/pkcs11-spy.c

  Log Message:
  -----------
  Fix Coverity CID 13692

Add an explicit null check for `po` after `init_spy()` in `C_Initialize` to prevent a potential null pointer dereference (FORWARD_NULL).

  Commit: aaea6304bc1f63233c8a9d3524c7ac2f62213873
      https://github.com/OpenSC/OpenSC/commit/aaea6304bc1f63233c8a9d3524c7ac2f62213873
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/asn1.c

  Log Message:
  -----------
  Fix Coverity CID 13628

Remove logically dead code in `sc_asn1_read_tag`. The variable `left` is already checked for zero at the beginning of the function, making the subsequent `if (left < 1)` check redundant.

  Commit: 25c905890148acdc79404f42b0c324b6bf37ce6b
      https://github.com/OpenSC/OpenSC/commit/25c905890148acdc79404f42b0c324b6bf37ce6b
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tests/lottery.c

  Log Message:
  -----------
  Fix Coverity CID 13620

Check the return value of `sc_lock` in `lottery.c` to ensure the card is successfully locked before attempting to get a challenge.

  Commit: b3e327b35cf336a308f4e73f09e9e866be30d9e7
      https://github.com/OpenSC/OpenSC/commit/b3e327b35cf336a308f4e73f09e9e866be30d9e7
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/pkcs15init/pkcs15-lib.c

  Log Message:
  -----------
  Fix Coverity CID 13604

Check the return value of `sc_select_file` in `sc_pkcs15init_update_any_df` and log the error if the selection fails. This satisfies Coverity's CHECKED_RETURN requirement without aborting the execution flow.

  Commit: 5faa184a5e00ebb8c826529286086749ca239e29
      https://github.com/OpenSC/OpenSC/commit/5faa184a5e00ebb8c826529286086749ca239e29
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/tools/pkcs11-tool.c

  Log Message:
  -----------
  Partially Fix Coverity CID 127059

Replace `rand()` in `pseudo_randomize` (`src/tools/pkcs11-tool.c`) with OpenSSL's `RAND_bytes` if available.

  Commit: f25f75278118f5a1ff0deaa1cc94d09a0488268d
      https://github.com/OpenSC/OpenSC/commit/f25f75278118f5a1ff0deaa1cc94d09a0488268d
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/common/simclist.c

  Log Message:
  -----------
  Fix Coverity CID 13627

Fix a logic error in `simclist.c` RNG selection by changing `#ifdef
SIMCLIST_SYSTEM_RNG` to `#ifndef SIMCLIST_SYSTEM_RNG`. This now defaults
to the local LCG algorithm as originally intended, avoiding the standard
`rand()` call and resolving Coverity's DC.WEAK_CRYPTO warning.

Adds Windows compatibility for seeding the LCG with PID

  Commit: 3a6b48a69dad5ad445c304285c30de8de85f801f
      https://github.com/OpenSC/OpenSC/commit/3a6b48a69dad5ad445c304285c30de8de85f801f
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/base64.c

  Log Message:
  -----------
  Fix Coverity CID 427421

Revert `c` and `s` to signed `int` in `base64.c`. Using `unsigned int`
caused an underflow to `UINT_MAX` during intentional negative decrements
(such as `c--` when skipping newlines or `s -= 6` at loop exit),
triggering Coverity's INTEGER_OVERFLOW warning.

  Commit: 096db065eac87a477e671a852a43f95b7410be42
      https://github.com/OpenSC/OpenSC/commit/096db065eac87a477e671a852a43f95b7410be42
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/common/simclist.c

  Log Message:
  -----------
  simlistc: fixed compiler warning

  Commit: 9ad6370512dd241e7770bd8bb3d59b1aa70e7c6c
      https://github.com/OpenSC/OpenSC/commit/9ad6370512dd241e7770bd8bb3d59b1aa70e7c6c
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M src/libopensc/pkcs15.c

  Log Message:
  -----------
  Fixes Coverity CID 505671

Removed unused variable buf and its dead code in sc_pkcs15_bind_internal.

  Commit: 4722d587386228b77b393919be48496c834fb95d
      https://github.com/OpenSC/OpenSC/commit/4722d587386228b77b393919be48496c834fb95d
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M src/libopensc/card-npa.c
    M src/libopensc/pkcs15-syn.c
    M src/pkcs15init/pkcs15-lib.c

  Log Message:
  -----------
  fixed formatting

  Commit: a6f4fdc0d4061a77f34826e939c44e286e592536
      https://github.com/OpenSC/OpenSC/commit/a6f4fdc0d4061a77f34826e939c44e286e592536
  Author: Frank Morgner <fra...@gm...>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M AGENTS.md
    M src/common/simclist.c
    M src/libopensc/asn1.c
    M src/libopensc/base64.c
    M src/libopensc/card-cac.c
    M src/libopensc/card-coolkey.c
    M src/libopensc/card-npa.c
    M src/libopensc/card-openpgp.c
    M src/libopensc/card-piv.c
    M src/libopensc/log.c
    M src/libopensc/pkcs15-sc-hsm.c
    M src/libopensc/pkcs15-syn.c
    M src/libopensc/pkcs15.c
    M src/pkcs11/pkcs11-spy.c
    M src/pkcs15init/pkcs15-lib.c
    M src/tests/fuzzing/fuzz_asn1_sig_value.c
    M src/tests/fuzzing/fuzz_piv_tool.c
    M src/tests/fuzzing/fuzz_pkcs15_tool.c
    M src/tests/fuzzing/fuzz_pkcs15init.c
    M src/tests/lottery.c
    M src/tools/opensc-tool.c
    M src/tools/pkcs11-tool.c

  Log Message:
  -----------
  Fix issues reported by Oss-Fuzz and Coverity

Fix issues reported by Oss-Fuzz

Compare: https://github.com/OpenSC/OpenSC/compare/a6587f0ac26a...a6f4fdc0d406

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSC/OpenSC/settings/notifications

[Opensc-commits] [OpenSC/OpenSC] 06a552: asn1: fix uninitialized pointer free on empty objects

OpenSC - tools and libraries for smart cards

[Opensc-commits] [OpenSC/OpenSC] 06a552: asn1: fix uninitialized pointer free on empty objects