Backport from minidriver: 11788a4a36bf83a01104700f171774336086e9b4
commit 11788a4a36bf83a01104700f171774336086e9b4 Author: Dave Pate <dpate@yubico.com> Date: Tue Jul 18 18:28:48 2017 -0700 Fixes #114 - jump to cleanup section in ykpiv_util_write_mscmap on invalid size
This commit is contained in:
+4
-1
@@ -469,7 +469,10 @@ ykpiv_rc ykpiv_util_write_mscmap(ykpiv_state *state, ykpiv_container *containers
|
|||||||
// calculate the required length of the encoded object
|
// calculate the required length of the encoded object
|
||||||
req_len = 1 /* data tag */ + _ykpiv_set_length(buf, data_len) + data_len;
|
req_len = 1 /* data tag */ + _ykpiv_set_length(buf, data_len) + data_len;
|
||||||
|
|
||||||
if (req_len > _obj_size_max(state)) return YKPIV_SIZE_ERROR;
|
if (req_len > _obj_size_max(state)) {
|
||||||
|
res = YKPIV_SIZE_ERROR;
|
||||||
|
goto Cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
buf[offset++] = TAG_MSCMAP;
|
buf[offset++] = TAG_MSCMAP;
|
||||||
offset += _ykpiv_set_length(buf + offset, data_len);
|
offset += _ykpiv_set_length(buf + offset, data_len);
|
||||||
|
|||||||
Reference in New Issue
Block a user