}
fn transmit_apdu(card: &Card, mut apdu: &[u8]) -> Result<String, Box<dyn std::error::Error>> {
- if apdu[0] == 0xff && apdu[1] == 0xff && apdu[2] == 0x01 && apdu[3] == 0x04 {
+ if apdu.len() >= 11 && apdu[0] == 0xff && apdu[1] == 0xff && apdu[2] == 0x01 && apdu[3] == 0x04 {
// APDUs with PIN codes are obfuscated (see /getref/ above)
// with a special extension header used only in scproxy. The format seems to be:
//
let apdus = get_apducommands(req.clone())?;
let mut any_sensitive = false;
for apdu in &apdus {
- if apdu[0] == 0xff && apdu[1] == 0xff {
+ if apdu.len() >= 2 && apdu[0] == 0xff && apdu[1] == 0xff {
any_sensitive = true;
}
}