FIX: LEGIC - potential stack corruption calculating CRC from user input

[proxmark3-svn] / client / cmdhflegic.c

diff --git a/client/cmdhflegic.c b/client/cmdhflegic.c
index d6aaaf3d0bc5dd1ddd5db727cceef107a42a39f0..9168258122140048a1ec15156a2d4d18f302b60b 100644 (file)
--- a/client/cmdhflegic.c
+++ b/client/cmdhflegic.c
@@ -14,32 +14,36 @@ static int CmdHelp(const char *Cmd);
 int usage_legic_calccrc8(void){
        PrintAndLog("Calculates the legic crc8/crc16 on the input hexbytes.");
        PrintAndLog("There must be an even number of hexsymbols as input.");
-       PrintAndLog("Usage:  hf legic crc8 [h] b <hexbytes> u <uidcrc>");
-       PrintAndLog("Options :");
+       PrintAndLog("Usage:  hf legic crc8 [h] b <hexbytes> u <uidcrc> c <crc type>");
+       PrintAndLog("Options:");
        PrintAndLog("      b <hexbytes>  : hex bytes");
        PrintAndLog("      u <uidcrc>    : MCC hexbyte");
+       PrintAndLog("      c <crc type>  : 8|16 bit crc size");
        PrintAndLog("");
-       PrintAndLog("Samples :");
+       PrintAndLog("Samples:");
        PrintAndLog("      hf legic crc8 b deadbeef1122");
-       PrintAndLog("      hf legic crc8 b deadbeef1122 u 9A");
+       PrintAndLog("      hf legic crc8 b deadbeef1122 u 9A c 16");
        return 0;
 }
 
 int usage_legic_load(void){
        PrintAndLog("It loads datasamples from the file `filename` to device memory");
        PrintAndLog("Usage:  hf legic load <file name>");
-       PrintAndLog(" sample: hf legic load filename");
+       PrintAndLog("");
+       PrintAndLog("Samples:");
+       PrintAndLog("      hf legic load filename");
        return 0;
 }
 
 int usage_legic_read(void){    
        PrintAndLog("Read data from a legic tag.");
        PrintAndLog("Usage:  hf legic read <offset> <num of bytes>");
-       PrintAndLog("Options :");
+       PrintAndLog("Options:");
        PrintAndLog("  <offset>        : offset in data array to start download from");
        PrintAndLog("  <num of bytes>  : number of bytes to download");
        PrintAndLog("");
-       PrintAndLog(" sample: hf legic read");
+       PrintAndLog("Samples:");
+       PrintAndLog("      hf legic read");
        return 0;
 }
 
@@ -523,8 +527,7 @@ int CmdLegicRfRawWrite(const char *Cmd) {
                PrintAndLog("# changing the DCF is irreversible  #");
                PrintAndLog("#####################################");
                PrintAndLog("do youe really want to continue? y(es) n(o)");             
-               scanf(" %c", &answer);
-               if (answer == 'y' || answer == 'Y') {
+               if (scanf(" %c", &answer) > 0 && (answer == 'y' || answer == 'Y')) {
                        SendCommand(&c);
                        return 0;
                }
@@ -547,7 +550,7 @@ int CmdLegicRfFill(const char *Cmd) {
 
     int i;
     UsbCommand c = {CMD_DOWNLOADED_SIM_SAMPLES_125K, {0, 0, 0}};
-       memcpy(c.d.asBytes, cmd.arg[2], 48);
+       memset(c.d.asBytes, cmd.arg[2], 48);
 
        for(i = 0; i < 22; i++) {
                c.arg[0] = i*48;
@@ -563,24 +566,40 @@ int CmdLegicRfFill(const char *Cmd) {
 
 int CmdLegicCalcCrc8(const char *Cmd){
 
-       uint8_t *data;
+       uint8_t *data = NULL;
        uint8_t cmdp = 0, uidcrc = 0, type=0;
        bool errors = false;
        int len = 0;
+       int bg, en;
        
        while(param_getchar(Cmd, cmdp) != 0x00) {
                switch(param_getchar(Cmd, cmdp)) {
                case 'b':
                case 'B':
-                       data = malloc(len);
+                       // peek at length of the input string so we can
+                       // figure out how many elements to malloc in "data"
+                       bg=en=0;
+                       param_getptr(Cmd, &bg, &en, cmdp+1);
+                       len = (en - bg + 1);
+
+                       // check that user entered even number of characters
+                       // for hex data string
+                       if (len & 1) {
+                               errors = true;
+                               break;
+                       }
+
+                       // it's possible for user to accidentally enter "b" parameter
+                       // more than once - we have to clean previous malloc
+                       if (data) free(data);
+                       data = malloc(len >> 1);
                        if ( data == NULL ) {
                                PrintAndLog("Can't allocate memory. exiting");
                                errors = true;
                                break;
-                       }                       
-                       param_gethex_ex(Cmd, cmdp+1, data, &len);
-                       // if odd symbols, (hexbyte must be two symbols)
-                       if ( len & 1 ) errors = true;
+                       }
+                       
+                       param_gethex(Cmd, cmdp+1, data, len);
 
                        len >>= 1;      
                        cmdp += 2;
@@ -608,7 +627,7 @@ int CmdLegicCalcCrc8(const char *Cmd){
        }
        //Validations
        if (errors){
-               if (data != NULL) free(data);
+               if (data) free(data);
                return usage_legic_calccrc8();
        }
        
@@ -621,7 +640,7 @@ int CmdLegicCalcCrc8(const char *Cmd){
                        break;
        }
        
-       free(data);
+       if (data) free(data);
        return 0;
 }