fix memory overflow in hf mf nested (issue #479)

[proxmark3-svn] / client / cmdhfmf.c

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 553803c1ef371f2d6bbcb069733bd785b67b0406..eed6b34c64af26e3d027e19564bec7d0757683a2 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -527,13 +527,12 @@ int CmdHF14AMfRestore(const char *Cmd)
 //----------------------------------------------\r
 //   Nested\r
 //----------------------------------------------\r
-# define NESTED_KEY_COUNT 15\r
 \r
 static void parseParamTDS(const char *Cmd, const uint8_t indx, bool *paramT, bool *paramD, uint8_t *timeout) {\r
        char ctmp3[3] = {0};\r
        int len = param_getlength(Cmd, indx);\r
        if (len > 0 && len < 4){\r
-               param_getstr(Cmd, indx, ctmp3);\r
+               param_getstr(Cmd, indx, ctmp3, sizeof(ctmp3));\r
                \r
                *paramT |= (ctmp3[0] == 't' || ctmp3[0] == 'T');\r
                *paramD |= (ctmp3[0] == 'd' || ctmp3[0] == 'D');\r
@@ -563,7 +562,7 @@ int CmdHF14AMfNested(const char *Cmd)
        uint8_t trgKeyType = 0;\r
        uint8_t SectorsCnt = 0;\r
        uint8_t key[6] = {0, 0, 0, 0, 0, 0};\r
-       uint8_t keyBlock[NESTED_KEY_COUNT * 6];\r
+       uint8_t keyBlock[MifareDefaultKeysSize * 6];\r
        uint64_t key64 = 0;\r
        // timeout in units. (ms * 106)/10 or us*0.0106\r
        uint8_t btimeout14a = MF_CHKKEYS_DEFTIMEOUT; // fast by default\r
@@ -713,7 +712,7 @@ int CmdHF14AMfNested(const char *Cmd)
                }\r
 \r
                PrintAndLog("Testing known keys. Sector count=%d", SectorsCnt);\r
-               mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, NESTED_KEY_COUNT, keyBlock, e_sector);\r
+               mfCheckKeysSec(SectorsCnt, 2, btimeout14a, true, MifareDefaultKeysSize, keyBlock, e_sector);\r
                \r
                // get known key from array\r
                bool keyFound = false;\r
@@ -1043,7 +1042,7 @@ int CmdHF14AMfChk(const char *Cmd)
        // double parameters - ts, ds\r
        int clen = param_getlength(Cmd, 2);\r
        if (clen == 2 || clen == 3){\r
-               param_getstr(Cmd, 2, ctmp3);\r
+               param_getstr(Cmd, 2, ctmp3, sizeof(ctmp3));\r
                ctmp = ctmp3[1];\r
        }\r
        //parse\r
@@ -1075,7 +1074,7 @@ int CmdHF14AMfChk(const char *Cmd)
                        keycnt++;\r
                } else {\r
                        // May be a dic file\r
-                       if ( param_getstr(Cmd, 2 + i,filename) >= FILE_PATH_SIZE ) {\r
+                       if ( param_getstr(Cmd, 2 + i, filename, sizeof(filename)) >= FILE_PATH_SIZE ) {\r
                                PrintAndLog("File name too long");\r
                                free(keyBlock);\r
                                return 2;\r
@@ -1398,7 +1397,7 @@ int CmdHF14AMf1kSim(const char *Cmd) {
                        break;\r
                case 'f':\r
                case 'F':\r
-                       len = param_getstr(Cmd, cmdp+1, filename);\r
+                       len = param_getstr(Cmd, cmdp+1, filename, sizeof(filename));\r
                        if (len < 1) {\r
                                PrintAndLog("error no filename found");\r
                                return 0;\r
@@ -1674,7 +1673,7 @@ int CmdHF14AMfELoad(const char *Cmd)
                }\r
        }\r
 \r
-       len = param_getstr(Cmd,nameParamNo,filename);\r
+       len = param_getstr(Cmd,nameParamNo,filename,sizeof(filename));\r
 \r
        if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
@@ -1773,7 +1772,7 @@ int CmdHF14AMfESave(const char *Cmd)
                }\r
        }\r
 \r
-       len = param_getstr(Cmd,nameParamNo,filename);\r
+       len = param_getstr(Cmd,nameParamNo,filename,sizeof(filename));\r
 \r
        if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
@@ -2137,7 +2136,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
                }\r
                return 0;\r
        } else {\r
-               param_getstr(Cmd, 0, filename);\r
+               param_getstr(Cmd, 0, filename, sizeof(filename));\r
 \r
                len = strlen(filename);\r
                if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
@@ -2348,7 +2347,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
                }\r
                return 0;\r
        } else {\r
-               param_getstr(Cmd, 0, filename);\r
+               param_getstr(Cmd, 0, filename, sizeof(filename));\r
 \r
                len = strlen(filename);\r
                if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r