When composite DO is parsed by find_tlv function, the original buffer length is ignored to call do_find_tlv recursively, but it uses the (claimed) length of the composite DO. This may be wrong.

From the original report:

If there is a composite object whose declared length exceeds the response, the parser returns a pointer that goes beyond the end of the response buffer and the length declared by the attacker.

When scdaemon registers a card application (in app_new_register in scd/app.c), it parses the GDO serial number using find_tlv_unchecked, which consumes a pointer.
If the caller’s check results in an underflow, a large memmove operation is performed into a short response buffer on the heap.
As a result, a heap corruption occurs in the user’s scdaemon process.
An attacker only needs to provide a card or token; no PIN or other credentials are required.

Reported-by: eris <security [at] eris.rs>