agnoctopus / libu2f-emu Goto Github PK

Hi César,

Do you have any plan to support CTAP2.0 protocol?

Most places in the code attempt to handle failure of malloc() and return gracefully, but the crypto code mostly ignores the return value. In the best case this means that the crypto code will likely de-reference NULL and crash. eg

    /* Allocate */
    *buffer = malloc(size + 32);
    int len = 0;
    size_t result_len = 0;

    /* Decrypr */
    if (EVP_DecryptUpdate(ctx, *buffer, &len, data, size) != 1)

results in passing a NULL into EVP_DecryptUpdate which cant be good.

The shared library exposes various symbols that should be private, or correctly namespaced.

Using a version script on linux is usually recommended, or export-symbols list for OS that don't support it.