NFCのトピックRe: FCI buffer size of when calling phalVca_IsoSelect()

FCI buffer size of when calling phalVca_IsoSelect()

timriddermann — Tue, 11 Aug 2020 12:38:42 GMT

Hello.

I wonder how big the buffer size of the FCI must be when I call the function phalVca_IsoSelect()?

In an example of the NXP Reader Library for DESFire EV2, the buffer "uint8_t FCI[40];" is created and passed to the function.However, I am afraid that a buffer overflow can occur if an FCI is received from the DESFire which is larger than 40 bytes. As far as I know this can happen if the file 31 of the DESFire is larger than 40 bytes.

Best regards,
Tim

Re: FCI buffer size of when calling phalVca_IsoSelect()

Jonathan_Iglesias — Tue, 01 Sep 2020 02:38:43 GMT

Hi ,

I am not sure to which example for EV2 you are referring, the examples available are for EV1.

Jonathan

Re: FCI buffer size of when calling phalVca_IsoSelect()

timriddermann — Wed, 15 Sep 2021 14:35:45 GMT

Hi,

sorry for the late repy. I was not notified of your reply and then I forgot about this thread a bit....

My question is not so much about the example but more about how the method 'phalVca_IsoSelect()' is to be used. I took a closer look at the code and think that a buffer overflow is possible in the method 'phalVca_Sw_IsoSelect()' (in file 'phalVca_Sw.c'), which is called from 'phalVca_IsoSelect()'.

My concerns is that 'pFCI' will overflow if the file 31 of a DESFire is larger than the buffer behind 'pFCI'. The memcpy is wrong in my opinion without a prior check of the buffer size.

"NFC Reader Library v06.11.00 for CLRC663 including all software examples"; File 'phalVca_Sw.c'; line 735-737

/* FCI contains contents of FileID 31 of the DF */
memcpy(pFCI, &pRecv[0], wRxlen-2);
*pwFCILen = wRxlen - 2;