chaosrebel/pico-openpgp
1
0
Fork 0
mirror of https://github.com/polhenarejos/pico-openpgp.git synced 2026-08-23 04:57:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Reject malformed VERIFY bodies without retry loss

Browse Source 
Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
This commit is contained in:
Pol Henarejos
2026-08-14 23:36:00 +02:00
parent b686df8684
commit d626852c13
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openpgp/piv.c
+5
View File
@@ -448,6 +448,11 @@ static int cmd_piv_verify(void) {
mbedtls_platform_zeroize(session_pwpiv, sizeof(session_pwpiv));
return SW_OK();
}
if (apdu.nc > 0 && apdu.nc != PIV_PIN_WIRE_SIZE) {
has_pwpiv = false;
mbedtls_platform_zeroize(session_pwpiv, sizeof(session_pwpiv));
return SW_INCORRECT_PARAMS();
}
if (apdu.nc > 0) {
uint16_t ret = check_pin(pw, apdu.data, apdu.nc);
if (ret == 0x9000) {
tests/piv/test_060_regressions.py
+7
View File
@@ -129,6 +129,13 @@ def test_piv_reference_changes_require_two_wire_blocks(piv, instruction, p2):
assert_apdu_error(lambda: piv.protocol.send_apdu(0, instruction, 0, p2, b"12345678"), SW.INCORRECT_PARAMETERS)
@pytest.mark.parametrize("body", (b"123456", b"123456789"))
def test_piv_verify_requires_the_wire_length_without_burning_a_retry(piv, body):
piv.verify_pin(DEFAULT_PIN)
assert_apdu_error(lambda: piv.protocol.send_apdu(0, 0x20, 0, 0x80, body), SW.INCORRECT_PARAMETERS)
assert_apdu_error(lambda: piv.protocol.send_apdu(0, 0x20, 0, 0x80, b""), 0x63C3)
def test_piv_card_authentication_key_is_pin_free_by_default(managed_piv):
slot = SLOT.CARD_AUTH
try: