Origin: https://github.com/OpenSC/OpenSC/commit/5631e9843c832a99769def85b7b9b68b4e3e3959 From: Veronika Hanulikova Date: Fri, 3 Mar 2023 16:07:38 +0100 Subject: Check length of string before making copy Thanks OSS-Fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55851 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=55998 CVE: CVE-2023-40661 Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: Virendra Thakur Comment: Hunk refreshed based on codebase. --- src/pkcs15init/profile.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/pkcs15init/profile.c b/src/pkcs15init/profile.c index 2b793b0282..3bad1e8536 100644 --- a/src/pkcs15init/profile.c +++ b/src/pkcs15init/profile.c @@ -1465,6 +1465,8 @@ while (argc--) { unsigned int op, method, id; + if (strlen(*argv) >= sizeof(oper)) + goto bad; strlcpy(oper, *argv++, sizeof(oper)); if ((what = strchr(oper, '=')) == NULL) goto bad; @@ -2128,6 +2130,9 @@ return get_uint(cur, value, type); } + if (strlen(value) >= sizeof(temp)) + return 1; + n = strcspn(value, "0123456789x"); strlcpy(temp, value, (sizeof(temp) > n) ? n + 1 : sizeof(temp));