Merge pull request #2 from gxcreator/fix_transports_parsing

fix(cred_mgmt): check array bounds when populating credentialId.trans…

Author: Lab-8916100448256

src/fido/cbor_cred_mgmt.c

@@ -79,6 +79,9 @@ int cbor_cred_mgmt(const uint8_t *data, size_t len) {
                         if (strcmp(_fd3, "transports") == 0) {
                             CBOR_PARSE_ARRAY_START(_f3, 4)
                             {
+                                if (credentialId.transports_len >= MAX_TRANSPORT_COUNT) {
+                                    CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                                }
                                 CBOR_FIELD_GET_TEXT(credentialId.transports[credentialId.transports_len], 4);
                                 credentialId.transports_len++;
                             }

src/fido/cbor_get_assertion.c

@@ -124,6 +124,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
         else if (val_u == 0x03) { // excludeList
             CBOR_PARSE_ARRAY_START(_f1, 2)
             {
+                if (allowList_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
+                    CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                }
                 PublicKeyCredentialDescriptor *pc = &allowList[allowList_len];
                 CBOR_PARSE_MAP_START(_f2, 3)
                 {
@@ -133,6 +136,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
                     if (strcmp(_fd3, "transports") == 0) {
                         CBOR_PARSE_ARRAY_START(_f3, 4)
                         {
+                            if (pc->transports_len >= MAX_TRANSPORT_COUNT) {
+                                CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                            }
                             CBOR_FIELD_GET_TEXT(pc->transports[pc->transports_len], 4);
                             pc->transports_len++;
                         }
@@ -481,6 +487,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
                 }
                 numberOfCredentialsx = numberOfCredentials;
                 datax = (uint8_t *) calloc(1, len);
+                if (datax == NULL) {
+                    CBOR_ERROR(CTAP1_ERR_OTHER);
+                }
                 memcpy(datax, data, len);
                 lenx = len;
                 flagsx = flags;
@@ -608,6 +617,9 @@ int cbor_get_assertion(const uint8_t *data, size_t len, bool next) {
 
     size_t aut_data_len = 32 + 1 + 4 + ext_len;
     aut_data = (uint8_t *) calloc(1, aut_data_len + clientDataHash.len);
+    if (aut_data == NULL) {
+        CBOR_ERROR(CTAP1_ERR_OTHER);
+    }
     uint8_t *pa = aut_data;
     memcpy(pa, rp_id_hash, 32); pa += 32;
     *pa++ = flags;

src/fido/cbor_make_credential.c

@@ -92,6 +92,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
         else if (val_u == 0x04) { // pubKeyCredParams
             CBOR_PARSE_ARRAY_START(_f1, 2)
             {
+                if (pubKeyCredParams_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
+                    CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                }
                 PublicKeyCredentialParameters *pk = &pubKeyCredParams[pubKeyCredParams_len];
                 CBOR_PARSE_MAP_START(_f2, 3)
                 {
@@ -107,6 +110,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
         else if (val_u == 0x05) { // excludeList
             CBOR_PARSE_ARRAY_START(_f1, 2)
             {
+                if (excludeList_len >= MAX_CREDENTIAL_COUNT_IN_LIST) {
+                    CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                }
                 PublicKeyCredentialDescriptor *pc = &excludeList[excludeList_len];
                 CBOR_PARSE_MAP_START(_f2, 3)
                 {
@@ -116,6 +122,9 @@ int cbor_make_credential(const uint8_t *data, size_t len) {
                     if (strcmp(_fd3, "transports") == 0) {
                         CBOR_PARSE_ARRAY_START(_f3, 4)
                         {
+                            if (pc->transports_len >= MAX_TRANSPORT_COUNT) {
+                                CBOR_ERROR(CTAP2_ERR_LIMIT_EXCEEDED);
+                            }
                             CBOR_FIELD_GET_TEXT(pc->transports[pc->transports_len], 4);
                             pc->transports_len++;
                         }

src/fido/cbor_make_credential.h

@@ -40,10 +40,12 @@ typedef struct PublicKeyCredentialParameters {
     int64_t alg;
 } PublicKeyCredentialParameters;
 
+#define MAX_TRANSPORT_COUNT 8
+
 typedef struct PublicKeyCredentialDescriptor {
     CborCharString type;
     CborByteString id;
-    CborCharString transports[8];
+    CborCharString transports[MAX_TRANSPORT_COUNT];
     size_t transports_len;
 } PublicKeyCredentialDescriptor;