From 7c894fc7fd1bcccbb9850ad1088c0f0ac006c427 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 3 Jul 2019 13:49:59 +0000 Subject: [PATCH 1/2] device_ledger: add paranoid buffer overflow check Coverity 200183 --- src/device/device_ledger.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/device/device_ledger.cpp b/src/device/device_ledger.cpp index eba633da8..2d91b881b 100644 --- a/src/device/device_ledger.cpp +++ b/src/device/device_ledger.cpp @@ -320,7 +320,9 @@ namespace hw { bool device_ledger::reset() { reset_buffer(); int offset = set_command_header_noopt(INS_RESET); - memmove(this->buffer_send+offset, MONERO_VERSION, strlen(MONERO_VERSION)); + const size_t verlen = strlen(MONERO_VERSION); + ASSERT_X(offset + verlen <= BUFFER_SEND_SIZE, "MONERO_VERSION is too long") + memmove(this->buffer_send+offset, MONERO_VERSION, verlen); offset += strlen(MONERO_VERSION); this->buffer_send[4] = offset-5; this->length_send = offset; From f07524b56b6e1c2302317c1c24c40eec26384089 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Wed, 3 Jul 2019 13:52:40 +0000 Subject: [PATCH 2/2] device_ledger: fix uninitialized additional_key Coverity 200185 --- src/device/device_ledger.hpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/device/device_ledger.hpp b/src/device/device_ledger.hpp index fe9028733..986087128 100644 --- a/src/device/device_ledger.hpp +++ b/src/device/device_ledger.hpp @@ -76,7 +76,7 @@ namespace hw { rct::key AKout; ABPkeys(const rct::key& A, const rct::key& B, const bool is_subaddr, bool is_subaddress, bool is_change_address, size_t index, const rct::key& P,const rct::key& AK); ABPkeys(const ABPkeys& keys) ; - ABPkeys() {index=0;is_subaddress=false;is_subaddress=false;is_change_address=false;} + ABPkeys() {index=0;is_subaddress=false;is_change_address=false;additional_key=false;} ABPkeys &operator=(const ABPkeys &keys); };