From f17dbee07a355402d92e3a2586a82a1d7131f916 Mon Sep 17 00:00:00 2001 From: Pol Henarejos Date: Fri, 14 Aug 2026 14:23:23 +0200 Subject: [PATCH] Enforce cardholder DO limits Signed-off-by: Pol Henarejos --- src/openpgp/cmd_put_data.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/openpgp/cmd_put_data.c b/src/openpgp/cmd_put_data.c index 0be1297..5abfb00 100644 --- a/src/openpgp/cmd_put_data.c +++ b/src/openpgp/cmd_put_data.c @@ -45,6 +45,15 @@ int cmd_put_data(void) { (apdu.data[0] == ALGO_RSA && apdu.nc < 3))) { return SW_WRONG_DATA(); } + if (fid == EF_CH_NAME && apdu.nc > 39u) { + return SW_WRONG_DATA(); + } + if (fid == EF_LANG_PREF && apdu.nc > 8u) { + return SW_WRONG_DATA(); + } + if (fid == EF_SEX && (apdu.nc > 1u || (apdu.nc > 0u && memchr("0129", apdu.data[0], 4) == NULL))) { + return SW_WRONG_DATA(); + } if (!(ef = file_search_by_fid(fid, NULL, SPECIFY_EF))) { return SW_WRONG_P1P2(); }