OTP: Check length of public ID.

Yubico · Apr 19, 2023 · b3e69b4 · b3e69b4
1 parent 4df0e4c
commit b3e69b4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/ykman/_cli/otp.py b/ykman/_cli/otp.py
@@ -428,6 +428,8 @@ def yubiotp(
  else:
  public_id = click_prompt("Enter public ID")
 
+ if len(public_id) % 2:
+ ctx.fail("Invalid public ID, length must be a multiple of 2.")
  try:
  public_id = modhex_decode(public_id)
  except ValueError:

diff --git a/yubikit/core/otp.py b/yubikit/core/otp.py
@@ -83,6 +83,9 @@ def modhex_encode(data: bytes) -> str:
 
 def modhex_decode(string: str) -> bytes:
  """Decode the Modhex (modified hexadecimal) string."""
+ if len(string) % 2:
+ raise ValueError("Length must be a multiple of 2")
+
  return bytes(
  MODHEX_ALPHABET.index(string[i]) << 4 | MODHEX_ALPHABET.index(string[i + 1])
  for i in range(0, len(string), 2)