From 7844361ad2d3f1eec6149a86d57790de392db63e Mon Sep 17 00:00:00 2001
From: Pol Henarejos <pol.henarejos@cttc.es>
Date: Fri, 14 Aug 2026 19:57:22 +0200
Subject: [PATCH] Reject unsupported secure-messaging class bytes

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
---
 src/apdu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/apdu.c b/src/apdu.c
index aa6938d..cbd69ce 100644
--- a/src/apdu.c
+++ b/src/apdu.c
@@ -73,6 +73,9 @@ int process_apdu(void) {
             is_chaining = false;
         }
     }
+    if (!(CLA(apdu) & 0x10) && (CLA(apdu) & 0x0C)) {
+        return SW_CLA_NOT_SUPPORTED();
+    }
     if (INS(apdu) == 0xA4 && P1(apdu) == 0x04 && (P2(apdu) == 0x00 || P2(apdu) == 0x4)) { //select by AID
         if (select_app(CONST_BYTE_ARRAY(apdu.data, apdu.nc)) == PICOKEYS_OK) {
             return SW_OK();