additional memory leaks, overflow and unchecked ...

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 21c0cde29bcdbb7cf7a08df8a89ddf310182cd2d..d306ac65c8aec1d35cca859707bd5800f79ce02f 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -875,6 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
                break;\r
        default:\r
                PrintAndLog("Key type must be A , B or ?");\r
+               free(keyBlock);\r
                return 1;\r
        };\r
        \r
@@ -926,6 +927,7 @@ int CmdHF14AMfChk(const char *Cmd)
                                                if (!p) {\r
                                                        PrintAndLog("Cannot allocate memory for defKeys");\r
                                                        free(keyBlock);\r
+                                                       fclose(f);\r
                                                        return 2;\r
                                                }\r
                                                keyBlock = p;\r
@@ -1219,7 +1221,7 @@ int CmdHF14AMfELoad(const char *Cmd)
        if (numblk2 > 0) numBlocks = numblk2;   \r
 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
-       if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+       if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
        fnameptr += len;\r
 \r
@@ -1316,7 +1318,7 @@ int CmdHF14AMfESave(const char *Cmd)
 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
        \r
-       if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+       if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
        \r
        // user supplied filename?\r
        if (len < 1) {\r
@@ -1593,7 +1595,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
                return 0;\r
        } else {\r
                len = strlen(Cmd);\r
-               if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+               if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
                memcpy(filename, Cmd, len);\r
                fnameptr += len;\r
@@ -1762,7 +1764,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
                return 0;\r
        } else {\r
                len = strlen(Cmd);\r
-               if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+               if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
                // get filename based on UID\r
                if (len < 1) {\r
@@ -1906,6 +1908,11 @@ int CmdHF14AMfSniff(const char *Cmd){
                                        bufsize = traceLen;\r
                                        memset(buf, 0x00, traceLen);\r
                                }\r
+                               if (bufPtr == NULL) {\r
+                                       PrintAndLog("Cannot allocate memory for trace");\r
+                                       free(buf);\r
+                                       return 2;\r
+                               }\r
                                memcpy(bufPtr, resp.d.asBytes, len);\r
                                bufPtr += len;\r
                                pckNum++;\r