Origin: https://github.com/OpenSC/OpenSC/commit/df5a176bfdf8c52ba89c7fef1f82f6f3b9312bc1 From: Veronika Hanulikova Date: Fri, 10 Feb 2023 11:47:34 +0100 Subject: Check array bounds Thanks OSS-Fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=54312 CVE: CVE-2023-40661 Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: Virendra Thakur Comment: Hunk refreshed based on codebase. --- src/libopensc/muscle.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/libopensc/muscle.c b/src/libopensc/muscle.c index 61a4ec24d8..9d01e0c113 100644 --- a/src/libopensc/muscle.c +++ b/src/libopensc/muscle.c @@ -183,6 +183,9 @@ sc_apdu_t apdu; int r; + if (dataLength + 9 > MSC_MAX_APDU) + return SC_ERROR_INVALID_ARGUMENTS; + sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, 0x54, 0x00, 0x00); apdu.lc = dataLength + 9; if (card->ctx->debug >= 2)