From 5e4f26b510b04624386c54816bf26aacea0fe4a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= <vhanulik@redhat.com>
Date: Thu, 11 Jul 2024 14:58:25 +0200
Subject: [PATCH] cac: Fix uninitialized values

Thanks Matteo Marini for report
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-p3mx-7472-h3j8

fuzz_card/1,fuzz_pkcs11/6
CVE: CVE-2024-45615
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/5e4f26b510b04624386c54816bf26aacea0fe4a1]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
---
 src/libopensc/card-cac.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/libopensc/card-cac.c b/src/libopensc/card-cac.c
index 1d1b616c8..4c3bc89bd 100644
--- a/src/libopensc/card-cac.c
+++ b/src/libopensc/card-cac.c
@@ -255,7 +255,7 @@ static int cac_apdu_io(sc_card_t *card, int ins, int p1, int p2,
 	size_t * recvbuflen)
 {
 	int r;
-	sc_apdu_t apdu;
+	sc_apdu_t apdu = {0};
 	u8 rbufinitbuf[CAC_MAX_SIZE];
 	u8 *rbuf;
 	size_t rbuflen;
@@ -392,13 +392,13 @@ fail:
 static int cac_read_file(sc_card_t *card, int file_type, u8 **out_buf, size_t *out_len)
 {
 	u8 params[2];
-	u8 count[2];
+	u8 count[2] = {0};
 	u8 *out = NULL;
-	u8 *out_ptr;
+	u8 *out_ptr = NULL;
 	size_t offset = 0;
 	size_t size = 0;
 	size_t left = 0;
-	size_t len;
+	size_t len = 0;
 	int r;
 
 	params[0] = file_type;
@@ -461,7 +461,7 @@ static int cac_read_binary(sc_card_t *card, unsigned int idx,
 	const u8 *tl_ptr, *val_ptr, *tl_start;
 	u8 *tlv_ptr;
 	const u8 *cert_ptr;
-	size_t tl_len, val_len, tlv_len;
+	size_t tl_len = 0, val_len = 0, tlv_len;
 	size_t len, tl_head_len, cert_len;
 	u8 cert_type, tag;
 
@@ -1528,7 +1528,7 @@ static int cac_parse_CCC(sc_card_t *card, cac_private_data_t *priv, const u8 *tl
 static int cac_process_CCC(sc_card_t *card, cac_private_data_t *priv, int depth)
 {
 	u8 *tl = NULL, *val = NULL;
-	size_t tl_len, val_len;
+	size_t tl_len = 0, val_len = 0;
 	int r;
 
 	if (depth > CAC_MAX_CCC_DEPTH) {
--
2.34.1
