apdu->rsp response buffer overflow risk

[edbek]

apdu->rsp response buffer overflow risk in uicc_file_ops.c
File:

onomondo-uicc/src/softsim/uicc/uicc_file_ops.c:740

Code:
c
if (memcmp(search_string, buf->data + search_offset, search_string_len) == 0) {
apdu->rsp[n_results] = search_record_number;
n_results++;
}

What's the gist: When searching for records (SEARCH RECORD), the found record numbers are written to apdu->rsp[n_results]. If there are many matches in the file (for example, 300 matches with a 256-byte buffer size), the resulting n_results++ overflow will lead to a Stack/Heap Buffer Overflow.
🛠️ Correction: Add condition if (n_results >= sizeof(apdu->rsp)) break;.