A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpivtransferdata(): {% highlight c %} if(outlen + recvlen - 2 > maxout) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", outlen + recvlen - 2, maxout); } if(outdata) { memcpy(outdata, data, recvlen - 2); outdata += recvlen - 2; outlen += recvlen - 2; } {% endhighlight %} -- it is clearly checked whether the buffer is big enough to hold the data copied using memcpy(), but no error handling happens to avoid the memcpy() in such cases. This code path can be triggered with malicious data coming from a smartcard.

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpivfetchobject(): {% highlight c %} if(sw == SWSUCCESS) { sizet outlen; int offs = ykpivgetlength(data + 1, &outlen); if(offs == 0) { return YKPIVSIZEERROR; } memmove(data, data + 1 + offs, outlen); len = outlen; return YKPIVOK; } else { return YKPIVGENERICERROR; } {% endhighlight %} -- in the end, a memmove() occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the memmove() could copy bytes behind the allocated data buffer into this buffer.