1-Wire Net Public Domain Kit 2.00 ========================================== =========== Errata 6/13/00 ============= ========================================== 1. File affected: owfile.c Procedure affected: int owReadFile(int portnum, uchar *filename, uchar *buf) Error description: (line 121) pglen = owReadPacketStd(portnum,TRUE,filepg,pgbuf); // check result of read if (pglen <= 0) return READ_ERROR; But pglen is declared as an unsigned char and will never be less than 0. Therefore is owReadPacketStd returns an error (-1), pglen has a value of 0xFF and the error is not caught. Consequently, if the size of the buffer passed in pointer buf < 255, this will create a difficult to find, buffer overflow. This would be common as the maximum size expected from a owReadPacketStd is 29 Bytes. Fix: Make pglen a signed value (int). 2. File affected: owfile.c Procedure affected: int owFormatWriteFile(uchar *filename, int fllen, uchar *buf) Error description: When the function is updating the bitmap for the DS1996 (type 0x0c) iButton, the bitmap image is incorrectly created if the file is larger than 220 pages. Fix: The line (221) if (i <= 221) should read if (i < 221) 3. File affected: ibsha18.c Procedure affected: int CreateMoneySecret(uchar *money_secret, TransState *ts) Error description: The last partial secret, in this case the only partial secret is left in the co-processor page after installation of the money master secret. Fix: Write over the page at the end of the secret insertion. (add at line 152, before the 'finish' in the script) { ST_TARGET_C_MMS, "C_Target co-processor money master secret" }, { ST_TARGET_PAGE, "C_Target page of secret" }, { ST_SET_BUFF_FF, "C_Set buffer to FF's" }, { ST_ERASE_SCRATCH, "C_Erase the scratchpad of the roving device" }, { ST_WRITE_SCRATCH, "C_Write the scratchpad" }, { ST_COPY_SCRATCH, "C_Copy the scratchpad" }, 4. File affected: ibsha18.c Procedure affected: int CreateAuthSecret(uchar *auth_secret, TransState *ts) Error description: The last partial secret, in this case the only partial secret is left in the co-processor page after installation of the authorization secret. Fix: Write over the page at the end of the secret insertion. (add at line 131, before the 'finish' in the script) { ST_TARGET_C_AMS, "C_Target co-processor auth master secret" }, { ST_TARGET_PAGE, "C_Target page of secret" }, { ST_SET_BUFF_FF, "C_Set buffer to FF's" }, { ST_ERASE_SCRATCH, "C_Erase the scratchpad of the roving device" }, { ST_WRITE_SCRATCH, "C_Write the scratchpad" }, { ST_COPY_SCRATCH, "C_Copy the scratchpad" },