return SW_WRONG_LENGTH for incorrect lc

fido2/apdu.c

@@ -9,7 +9,7 @@
 
 #include "apdu.h"
 
-int apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu) 
+uint16_t apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu) 
 {
     EXT_APDU_HEADER *hapdu = (EXT_APDU_HEADER *)data;
     
@@ -62,6 +62,11 @@ int apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu)
     if (len >= 7 && b0 == 0)
     {
         uint16_t extlen = (hapdu->lc[1] << 8) + hapdu->lc[2];
+
+        if (len - 7 < extlen)
+        {
+            return SW_WRONG_LENGTH;
+        }
         
          // case 2E (Le) - extended
         if (len == 7)
@@ -103,9 +108,18 @@ int apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu)
             apdu->le = 0x10000;
         }
     }
+    else
+    {
+        if ((len > 5) && (len - 5 < hapdu->lc[0]))
+        {
+            return SW_WRONG_LENGTH;
+        }
+    }
     
     if (!apdu->case_type)
-        return 1;
+    {
+        return SW_COND_USE_NOT_SATISFIED;
+    }
     
     if (apdu->lc)
     {

fido2/apdu.h

@@ -36,7 +36,7 @@ typedef struct
     uint8_t case_type;
 } __attribute__((packed)) APDU_STRUCT;
 
-extern int apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu);
+extern uint16_t apdu_decode(uint8_t *data, size_t len, APDU_STRUCT *apdu);
 
 #define APDU_FIDO_U2F_REGISTER        0x01
 #define APDU_FIDO_U2F_AUTHENTICATE    0x02

fido2/ctap.c

@@ -486,7 +486,7 @@ static int ctap_make_auth_data(struct rpId * rp, CborEncoder * map, uint8_t * au
     
     device_set_status(CTAPHID_STATUS_PROCESSING);
 
-    authData->head.flags = (but << 0);
+    authData->head.flags = (1 << 0);        // User presence
     authData->head.flags |= (ctap_is_pin_set() << 2);
 
 

targets/stm32l432/src/device.c

@@ -55,7 +55,16 @@ static int is_physical_button_pressed()
 
 static int is_touch_button_pressed()
 {
-    return tsc_read_button(0) || tsc_read_button(1);
+    int is_pressed = (tsc_read_button(0) || tsc_read_button(1));
+#ifndef IS_BOOTLOADER
+    if (is_pressed)
+    {
+        // delay for debounce, and longer than polling timer period.
+        delay(95);
+        return (tsc_read_button(0) || tsc_read_button(1));
+    }
+#endif
+    return is_pressed;
 }
 
 int (*IS_BUTTON_PRESSED)() = is_physical_button_pressed;
@@ -66,7 +75,7 @@ static void edge_detect_touch_button()
     uint8_t current_touch = 0;
     if (is_touch_button_pressed == IS_BUTTON_PRESSED)
     {
-        current_touch = IS_BUTTON_PRESSED();
+        current_touch = (tsc_read_button(0) || tsc_read_button(1));
 
         // 1 sample per 25 ms
         if ((millis() - __last_button_bounce_time) > 25)
@@ -153,7 +162,6 @@ void device_set_status(uint32_t status)
 
 int device_is_button_pressed()
 {
-
     return IS_BUTTON_PRESSED();
 }
 

targets/stm32l432/src/nfc.c

@@ -784,9 +784,10 @@ void nfc_process_iblock(uint8_t * buf, int len)
     }
     
     APDU_STRUCT apdu;
-    if (apdu_decode(buf + block_offset, len - block_offset, &apdu)) {
+    uint16_t ret = apdu_decode(buf + block_offset, len - block_offset, &apdu);
+    if (ret != 0) {
         printf1(TAG_NFC,"apdu decode error\r\n");
-        nfc_write_response(buf[0], SW_COND_USE_NOT_SATISFIED);
+        nfc_write_response(buf[0], ret);
         return;
     }
     printf1(TAG_NFC,"apdu ok. %scase=%02x cla=%02x ins=%02x p1=%02x p2=%02x lc=%d le=%d\r\n", 
@@ -802,7 +803,6 @@ void nfc_process_iblock(uint8_t * buf, int len)
         
         memmove(&chain_buffer[chain_buffer_len], apdu.data, apdu.lc);
         chain_buffer_len += apdu.lc;
-        delay(1);
         nfc_write_response(buf[0], SW_SUCCESS);
         printf1(TAG_NFC, "APDU chaining ok. %d/%d\r\n", apdu.lc, chain_buffer_len);
         return;
@@ -810,7 +810,6 @@ void nfc_process_iblock(uint8_t * buf, int len)
     
     // if we have ISO 7816 APDU chain - move there all the data
     if (!chain_buffer_tx && chain_buffer_len > 0) {
-        delay(1);
         memmove(&apdu.data[chain_buffer_len], apdu.data, apdu.lc);
         memmove(apdu.data, chain_buffer, chain_buffer_len);
         apdu.lc += chain_buffer_len; // here apdu struct does not match with memory!