commit 9d294de90d1cc66956389856e60b6944b27b4817

Author: Frank Morgner <frankmorgner@gmail.com>

Date:   Thu Jun 4 10:04:10 2020 +0200

    prevent out of bounds write

    fixes https://oss-fuzz.com/testcase-detail/5226571123392512

diff --git a/src/libopensc/card-tcos.c b/src/libopensc/card-tcos.c

index 673c2493..e88c80bd 100644

--- a/src/libopensc/card-tcos.c

+++ b/src/libopensc/card-tcos.c

@@ -623,6 +623,8 @@ static int tcos_decipher(sc_card_t *card, const u8 * crgram, size_t crgram_len,

 	apdu.data = sbuf;

 	apdu.lc = apdu.datalen = crgram_len+1;

 	sbuf[0] = tcos3 ? 0x00 : ((data->pad_flags & SC_ALGORITHM_RSA_PAD_PKCS1) ? 0x81 : 0x02);

+	if (sizeof sbuf - 1 < crgram_len)

+		return SC_ERROR_INVALID_ARGUMENTS;

 	memcpy(sbuf+1, crgram, crgram_len);

 	r = sc_transmit_apdu(card, &apdu);