google / OpenSK / 37745122579

97%

2.1: 97%

push

github

Fix APDU parsing of case 2E and malformed Le fields (#787)

Fixes #565

The APDU parser rejected valid case 2E command APDUs (an extended Le
with no command data): a request like 00 03 00 00 00 12 34 failed with
SW_WRONG_LENGTH, although the extended form is required to be supported
on all transports. U2F VERSION is impacted, since it is the only U2F
command that carries no data.

The parser also accepted malformed case 4E requests with a 3-byte Le
(00 Lc1 Lc2 data 00 Le1 Le2): the 0x00 marker of the extended Le is
only allowed when Lc is absent, i.e. in case 2E.

The decoder now follows the case table of ISO 7816-3:2006 section
12.1.3 and rejects with SW_WRONG_LENGTH every length field combination
that the standard does not define, replacing the SW_INTERNAL_EXCEPTION
that undecodable lengths used to return. The single short Le that may
follow an extended Lc is still tolerated, for compatibility with the
CTAP HID flavor of the U2F framing.

Co-authored-by: 17krishna8 <17krishna8@users.noreply.github.com>

163 of 166 new or added lines in 2 files covered. (98.19%)

13669 of 14056 relevant lines covered (97.25%)

4303.16 hits per line