From 4ab91aae6c101b72a94d3785dbdad117354b87d5 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Tue, 6 Dec 2016 20:22:37 +0100 Subject: Check maximum OTP secret size in new authorization style commands Authenticate before testing invalid hex strings Remove invalid test for empty string for writing otp slot (empty string allows editing) Signed-off-by: Szczepan Zalega --- NitrokeyManager.cc | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'NitrokeyManager.cc') diff --git a/NitrokeyManager.cc b/NitrokeyManager.cc index da31c8d..a15b9c8 100644 --- a/NitrokeyManager.cc +++ b/NitrokeyManager.cc @@ -302,6 +302,10 @@ namespace nitrokey{ payload2.id = 0; auto secret_bin = misc::hex_string_to_byte(secret); auto remaining_secret_length = secret_bin.size(); + const auto maximum_OTP_secret_size = 40; + if(remaining_secret_length > maximum_OTP_secret_size){ + throw TargetBufferSmallerThanSource(remaining_secret_length, maximum_OTP_secret_size); + } while (remaining_secret_length>0){ const auto bytesToCopy = std::min(sizeof(payload2.data), remaining_secret_length); -- cgit v1.2.1