[Opensc-commits] [OpenSC/OpenSC] ad7303: setcos: Fix buffer overflow in setcos_construct_fc...

[wanglanlan <no...@gi...>]

  Branch: refs/heads/master
  Home:   https://github.com/OpenSC/OpenSC
  Commit: ad730304052937c32b4eb489a06835ac6123632c
      https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c
  Author: wanglanlan <wan...@us...>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M src/libopensc/card-setcos.c

  Log Message:
  -----------
  setcos: Fix buffer overflow in setcos_construct_fci_44

The FCI construction copied type_attr, sec_attr and prop_attr of the
file into a fixed 64-byte stack buffer without checking the length.
Malicious or corrupted attribute lengths (e.g. prop_attr_len > 64,
reachable through fuzz_pkcs15init and attacker-controlled card
responses) caused a stack buffer overflow (write).

Return SC_ERROR_INVALID_DATA if any attribute exceeds the buffer size.

Found with the fuzz_pkcs15init fuzzer.

Co-Authored-By: Claude <no...@an...>



To unsubscribe from these emails, change your notification settings at https://github.com/OpenSC/OpenSC/settings/notifications