additional memory leaks, overflow and unchecked ...

return values fixed

thanks to iceman1001

diff --git a/client/cmdhfmf.c b/client/cmdhfmf.c
index 21c0cde29bcdbb7cf7a08df8a89ddf310182cd2d..d306ac65c8aec1d35cca859707bd5800f79ce02f 100644 (file)
--- a/client/cmdhfmf.c
+++ b/client/cmdhfmf.c
@@ -875,6 +875,7 @@ int CmdHF14AMfChk(const char *Cmd)
                break;\r
        default:\r
                PrintAndLog("Key type must be A , B or ?");\r
+               free(keyBlock);\r
                return 1;\r
        };\r
        \r
@@ -926,6 +927,7 @@ int CmdHF14AMfChk(const char *Cmd)
                                                if (!p) {\r
                                                        PrintAndLog("Cannot allocate memory for defKeys");\r
                                                        free(keyBlock);\r
+                                                       fclose(f);\r
                                                        return 2;\r
                                                }\r
                                                keyBlock = p;\r
@@ -1219,7 +1221,7 @@ int CmdHF14AMfELoad(const char *Cmd)
        if (numblk2 > 0) numBlocks = numblk2;   \r
 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
-       if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+       if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
        fnameptr += len;\r
 \r
@@ -1316,7 +1318,7 @@ int CmdHF14AMfESave(const char *Cmd)
 \r
        len = param_getstr(Cmd,nameParamNo,filename);\r
        \r
-       if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+       if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
        \r
        // user supplied filename?\r
        if (len < 1) {\r
@@ -1593,7 +1595,7 @@ int CmdHF14AMfCLoad(const char *Cmd)
                return 0;\r
        } else {\r
                len = strlen(Cmd);\r
-               if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+               if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
                memcpy(filename, Cmd, len);\r
                fnameptr += len;\r
@@ -1762,7 +1764,7 @@ int CmdHF14AMfCSave(const char *Cmd) {
                return 0;\r
        } else {\r
                len = strlen(Cmd);\r
-               if (len > FILE_PATH_SIZE - 4) len = FILE_PATH_SIZE - 4;\r
+               if (len > FILE_PATH_SIZE - 5) len = FILE_PATH_SIZE - 5;\r
 \r
                // get filename based on UID\r
                if (len < 1) {\r
@@ -1906,6 +1908,11 @@ int CmdHF14AMfSniff(const char *Cmd){
                                        bufsize = traceLen;\r
                                        memset(buf, 0x00, traceLen);\r
                                }\r
+                               if (bufPtr == NULL) {\r
+                                       PrintAndLog("Cannot allocate memory for trace");\r
+                                       free(buf);\r
+                                       return 2;\r
+                               }\r
                                memcpy(bufPtr, resp.d.asBytes, len);\r
                                bufPtr += len;\r
                                pckNum++;\r

diff --git a/client/util.c b/client/util.c
index c4f7d200f61bb096949c2e5939c9c48349da7431..e5cbc4aa11054fcd72a173af99a413d766362b2e 100644 (file)
--- a/client/util.c
+++ b/client/util.c
@@ -23,7 +23,7 @@ int ukbhit(void)
   static struct termios Otty, Ntty;
 
 
-  tcgetattr( 0, &Otty);
+  if ( tcgetattr( 0, &Otty) == -1 ) return -1;
   Ntty = Otty;
 
   Ntty.c_iflag          = 0;       /* input mode                */
@@ -140,8 +140,9 @@ char *sprint_bin_break(const uint8_t *data, const size_t len, const uint8_t brea
        size_t in_index = 0;
        // loop through the out_index to make sure we don't go too far
        for (size_t out_index=0; out_index < max_len; out_index++) {
-               // set character
-               sprintf(tmp++, "%u", data[in_index]);
+               // set character - (should be binary but verify it isn't more than 1 digit)
+               if (data[in_index]<10)
+                       sprintf(tmp++, "%u", data[in_index]);
                // check if a line break is needed and we have room to print it in our array
                if ( (breaks > 0) && !((in_index+1) % breaks) && (out_index+1 != max_len) ) {
                        // increment and print line break