Blob Blame Raw
From 792733e8aa8565a0b49c80539d0bc7a0ac19aaff Mon Sep 17 00:00:00 2001
From: Markus Armbruster <>
Date: Mon, 28 Nov 2011 20:27:37 +0100
Subject: [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ATR size exceeding the limit is diagnosed, but then we merrily use it
anyway, overrunning card->atr[].

The message is read from a character device.  Obvious security
implications unless the other end of the character device is trusted.

Spotted by Coverity.  CVE-2011-4111.

Signed-off-by: Markus Armbruster <>
Signed-off-by: Anthony Liguori <>
(cherry picked from commit 7e62255a4b3e0e2ab84a3ec7398640e8ed58620a)

Signed-off-by: Bruce Rogers <>
[AF: Fixes BNC#731086.]
Signed-off-by: Andreas Färber <>
 hw/ccid-card-passthru.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
index 28eb9d1..0505663 100644
--- a/hw/ccid-card-passthru.c
+++ b/hw/ccid-card-passthru.c
@@ -150,6 +150,7 @@ static void ccid_card_vscard_handle_message(PassthruState *card,
             error_report("ATR size exceeds spec, ignoring");
             ccid_card_vscard_send_error(card, scr_msg_header->reader_id,
+            break;
         memcpy(card->atr, data, scr_msg_header->length);
         card->atr_length = scr_msg_header->length;