dash/proxmark3
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

hf 15 - prepcmd beyond array boundery fix

Browse Source
This commit is contained in:
iceman1001
2021-02-22 13:12:37 +01:00
parent fad29cb755
commit b41be82a6c
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
client/src/cmdhf15.c
View File

@@ -575,6 +575,10 @@ bool readHF15Uid(bool loop, bool verbose) {
* **cmd command line * **cmd command line
*/ */
static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t *req, uint8_t iso15cmd) { // reqlen arg0 static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t *req, uint8_t iso15cmd) { // reqlen arg0
if (*cmd == NULL || strlen(*cmd) == 0)
return false;
int temp; int temp;
uint8_t uid[8] = {0x00}; uint8_t uid[8] = {0x00};
uint32_t tmpreqlen = 0; uint32_t tmpreqlen = 0;
@@ -598,13 +602,12 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t
// strip // strip
while (**cmd == ' ' || **cmd == '\t')(*cmd)++; while (**cmd == ' ' || **cmd == '\t')(*cmd)++;
switch (**cmd) { char c = tolower(**cmd);
switch (c) {
case 0: case 0:
PrintAndLogEx(WARNING, "missing addr"); PrintAndLogEx(WARNING, "missing addr");
return false; return false;
break;
case 'u': case 'u':
case 'U':
// unaddressed mode may not be supported by all vendors // unaddressed mode may not be supported by all vendors
req[tmpreqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY; req[tmpreqlen++] |= ISO15_REQ_SUBCARRIER_SINGLE | ISO15_REQ_DATARATE_HIGH | ISO15_REQ_NONINVENTORY;
req[tmpreqlen++] = iso15cmd; req[tmpreqlen++] = iso15cmd;
@@ -637,9 +640,9 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t
break; break;
} }
// skip to next space // skip to next space
while (**cmd != ' ' && **cmd != '\t')(*cmd)++; while (**cmd != NULL && **cmd != ' ' && **cmd != '\t')(*cmd)++;
// skip over the space // skip over the space
while (**cmd == ' ' || **cmd == '\t')(*cmd)++; while (**cmd != NULL && **cmd == ' ' || **cmd == '\t')(*cmd)++;
*reqlen = tmpreqlen; *reqlen = tmpreqlen;
return true; return true;