Eric Betts 8 месяцев назад
Родитель
Сommit
6cdc65c5b0
3 измененных файлов с 12 добавлено и 5 удалено
  1. 1 1
      seos_credential.h
  2. 1 0
      seos_emulator.c
  3. 10 4
      seos_reader.c

+ 1 - 1
seos_credential.h

@@ -23,7 +23,7 @@ typedef struct {
     uint8_t auth_key[16];
     size_t adf_oid_len;
     uint8_t adf_oid[32];
-    uint8_t adf_response[72];
+    uint8_t adf_response[80];
 
     char name[SEOS_FILE_NAME_MAX_LENGTH + 1];
     FuriString* load_path;

+ 1 - 0
seos_emulator.c

@@ -272,6 +272,7 @@ void seos_emulator_select_adf(
         FURI_LOG_I(TAG, "Using hardcoded ADF Response");
         bit_buffer_append_bytes(
             tx_buffer, credential->adf_response, sizeof(credential->adf_response));
+        bit_buffer_append_bytes(tx_buffer, success, sizeof(success));
         seos_log_bitbuffer(TAG, "Select ADF (0xcd02...)", tx_buffer);
         return;
     }

+ 10 - 4
seos_reader.c

@@ -306,10 +306,16 @@ bool seos_reader_select_adf_response(
     }
 
     memset(credential->adf_response, 0, sizeof(credential->adf_response));
-    memcpy(
-        credential->adf_response,
-        rx_data,
-        bit_buffer_get_size_bytes(rx_buffer) - offset - sizeof(success));
+    size_t response_length = bit_buffer_get_size_bytes(rx_buffer) - offset - sizeof(success);
+    if(response_length > sizeof(credential->adf_response)) {
+        FURI_LOG_W(
+            TAG,
+            "adf_response too large %zu > %zu",
+            response_length,
+            sizeof(credential->adf_response));
+        response_length = sizeof(credential->adf_response);
+    }
+    memcpy(credential->adf_response, rx_data, response_length);
 
     uint8_t* diversifier = clear + 2 + oidLen + 2;
     memcpy(credential->diversifier, diversifier, credential->diversifier_len);