Thales card support

[metsma]

IB-8171

Signed-off-by: Raul Metsma raul@metsma.ee

[mrts]

Let's follow defensive programming principles and protect against out of bounds writes.

Consider the following two cases:

Short command:

std::vector<uint8_t> cmd = {0x00,0x84,0x00,0x00};  // size()==4
size_t pos = cmd.size() <= 5 ? 4 : 5+cmd[4];  // pos==4
cmd[pos] = 0x08;  // write past end

Invalid Lc:

std::vector<uint8_t> cmd = {0x00,0xD0,0x00,0x00,0x10,  // Lc = 16
                            0xAA,0xBB,0xCC,0xDD,0xEE};  // only 5 data bytes, size()==10
size_t pos = 5 + cmd[4];  // 5 + 0x10 = 21
cmd[pos] = 0x08;  // write past end

We should throw cleanly and not write past end in these cases.

[mrts]

@metsma correctly pointed out that the command byte vector is always converted from a CommandApdu that internally guarantees that Lc is valid.

So the issue is actually more about type safety - getResponseWithLE() and transitively transmitBytes() should use a CommandApdu parameter, not a raw byte vector, something like this:

    void getResponseWithLE(ResponseApdu& response, const CommandApdu& command) const
    {
        ...
    }

    ResponseApdu transmitBytes(const CommandApdu& command) const
    {
        byte_vector commandBytes = command;
        byte_vector responseBytes(ResponseApdu::MAX_SIZE, 0);
        auto responseLength = DWORD(responseBytes.size());

        SCard(Transmit, cardHandle, &_protocol, commandBytes.data(), DWORD(commandBytes.size()),
              nullptr, responseBytes.data(), &responseLength);

        auto response = toResponse(std::move(responseBytes), responseLength);

        if (response.sw1 == ResponseApdu::WRONG_LE_LENGTH) {
            getResponseWithLE(response, command);
        }
        ...
    }

[mrts]

This should not be top level as it leaks everywhere the header is used, let's move it into readBinary() scope where it used.