From decb66ce9f73fb90d7956700d924a42a396c9ebb Mon Sep 17 00:00:00 2001
From: subrahmanyaman <subrahmanyaman@google.com>
Date: Fri, 2 Dec 2022 01:35:34 +0000
Subject: [PATCH] Fix for setIncomingAndReceive for T=0 protocol

---
 .../src/com/android/javacard/keymaster/KMAndroidSEApplet.java | 3 ++-
 .../src/com/android/javacard/keymaster/KMJCardSimApplet.java  | 3 ++-
 .../src/com/android/javacard/keymaster/KMKeymasterApplet.java | 4 +++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
index f3788eab..135e55bd 100644
--- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
+++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java
@@ -94,6 +94,7 @@ public void handleDeviceBooted() {
   @Override
   public void process(APDU apdu) {
     try {
+      receiveLen[0] = apdu.setIncomingAndReceive();
       handleDeviceBooted();
       // If this is select applet apdu which is selecting this applet then return
       if (apdu.isISOInterindustryCLA()) {
@@ -490,7 +491,7 @@ private void processProvisionAttestationKey(APDU apdu) {
 
   private void processProvisionAttestationCertDataCmd(APDU apdu) {
     byte[] srcBuffer = apdu.getBuffer();
-    short recvLen = apdu.setIncomingAndReceive();
+    short recvLen = receiveLen[0];
     short srcOffset = apdu.getOffsetCdata();
     short bufferLength = apdu.getIncomingLength();
     short bufferStartOffset = repository.allocReclaimableMemory(bufferLength);
diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
index 772f13de..a57420c0 100644
--- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
+++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java
@@ -85,6 +85,7 @@ public void handleDeviceBooted() {
   @Override
   public void process(APDU apdu) {
     try {
+      receiveLen[0] = apdu.setIncomingAndReceive();
       handleDeviceBooted();
       // If this is select applet apdu which is selecting this applet then return
       if (apdu.isISOInterindustryCLA()) {
@@ -486,7 +487,7 @@ private void processProvisionAttestationKey(APDU apdu) {
 
   private void processProvisionAttestationCertDataCmd(APDU apdu) {
     byte[] srcBuffer = apdu.getBuffer();
-    short recvLen = apdu.setIncomingAndReceive();
+    short recvLen = receiveLen[0];
     short srcOffset = apdu.getOffsetCdata();
     short bufferLength = apdu.getIncomingLength();
     short bufferStartOffset = repository.allocReclaimableMemory(bufferLength);
diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
index a606f022..d2c44bfa 100644
--- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
+++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
@@ -296,6 +296,7 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
   protected static short[] tmpVariables;
   protected static short[] data;
   protected static byte[] wrappingKey;
+  protected static short[] receiveLen;
 
   /**
    * Registers this applet.
@@ -311,6 +312,7 @@ protected KMKeymasterApplet(KMSEProvider seImpl) {
     tmpVariables =
         JCSystem.makeTransientShortArray(TMP_VARIABLE_ARRAY_SIZE, JCSystem.CLEAR_ON_DESELECT);
     wrappingKey = JCSystem.makeTransientByteArray((short)(WRAPPING_KEY_SIZE+1), JCSystem.CLEAR_ON_RESET);
+    receiveLen = JCSystem.makeTransientShortArray((short) 1, JCSystem.CLEAR_ON_RESET);
     resetWrappingKey();
     opTable = new KMOperationState[MAX_OPERATIONS_COUNT];
     short index = 0;
@@ -916,7 +918,7 @@ public void sendOutgoing(APDU apdu, KMAttestationCert cert, short certStart, sho
    */
   public static short receiveIncoming(APDU apdu, short reqExp) {
     byte[] srcBuffer = apdu.getBuffer();
-    short recvLen = apdu.setIncomingAndReceive();
+    short recvLen = receiveLen[0];
     short srcOffset = apdu.getOffsetCdata();
     // TODO add logic to handle the extended length buffer. In this case the memory can be reused
     //  from extended buffer.