From 2696349f161d7eb6de967c7d9480cc1b512eecbf Mon Sep 17 00:00:00 2001
From: iceman1001 <iceman@iuse.se>
Date: Wed, 13 May 2015 13:23:53 +0200
Subject: [PATCH] BUGS:  Coverty Scan, fixes some memory bugs

---
 client/cmddata.c  | 3 ++-
 client/cmdhfmf.c  | 6 +++---
 client/cmdhfmfu.c | 2 +-
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/client/cmddata.c b/client/cmddata.c
index 556ede06..a7430894 100644
--- a/client/cmddata.c
+++ b/client/cmddata.c
@@ -1892,7 +1892,8 @@ int getSamples(const char *Cmd, bool silent)
 		PrintAndLog("Unpacking...");
 		BitstreamOut bout = { got, bits_per_sample * n,  0};
 		int j =0;
-		for (j = 0; j * bits_per_sample < n * 8 && j < sizeof(GraphBuffer); j++) {
+		//for (j = 0; j * bits_per_sample < n * 8 && j < sizeof(GraphBuffer); j++) {
+			for (j = 0; j * bits_per_sample < n * 8 && j < n; j++) {
 			uint8_t sample = getByte(bits_per_sample, &bout);
 			GraphBuffer[j] = ((int) sample )- 128;
 		}
diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 0cf5bd7f..a4986f6b 100644
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -547,7 +547,7 @@ int CmdHF14AMfNested(const char *Cmd)
 	uint8_t trgKeyType = 0;
 	uint8_t SectorsCnt = 0;
 	uint8_t key[6] = {0, 0, 0, 0, 0, 0};
-	uint8_t keyBlock[13*6];
+	uint8_t keyBlock[14*6];
 	uint64_t key64 = 0;
 	bool transferToEml = false;
 	
@@ -1311,7 +1311,7 @@ int CmdHF14AMfESave(const char *Cmd)
 		for (j = 0; j < 7; j++, fnameptr += 2)
 			sprintf(fnameptr, "%02X", buf[j]); 
 	} else {
-		fnameptr += len;
+		fnameptr += len-4;
 	}
 
 	// add file extension
@@ -1575,7 +1575,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
 		if (len > FILE_PATH_SIZE) len = FILE_PATH_SIZE;
 
 		memcpy(filename, Cmd, len);
-		fnameptr += len;
+		fnameptr += len-4;
 
 		sprintf(fnameptr, ".eml"); 
 	
diff --git a/client/cmdhfmfu.c b/client/cmdhfmfu.c
index da8a0d27..e02c445d 100644
--- a/client/cmdhfmfu.c
+++ b/client/cmdhfmfu.c
@@ -1113,7 +1113,7 @@ int CmdHF14AMfUDump(const char *Cmd){
 		sprintf(fnameptr,"%02X%02X%02X%02X%02X%02X%02X.bin",
 			data[0], data[1], data[2], data[4], data[5], data[6], data[7]);
 	} else {
-		sprintf(fnameptr + fileNlen," .bin");
+		sprintf(fnameptr + fileNlen,".bin");
 	}
 
 	if ((fout = fopen(filename,"wb")) == NULL) { 
-- 
2.39.2