Merge pull request #3353 from AlxCzl/fix-mad1-loop-oob

Fix MAD1 off-by-one in MADDecode: loop read Key A as 16th AID

Author: iceman1001

client/src/mifare/mad.c

@@ -264,8 +264,7 @@ int MADDecode(uint8_t *sector0, uint8_t *sector16, uint16_t *mad, size_t *madlen
         PrintAndLogEx(INFO, "overriding crc check");
     }
 
-    // 7 + 8 == 15
-    for (int i = 1; i <= 16; i++) {
+    for (int i = 1; i < 16; i++) {
         mad[*madlen] = madGetAID(sector0, swapmad, 1, i);
         (*madlen)++;
     }

client/src/mifare/mad.h

@@ -21,8 +21,8 @@
 
 #include "common.h"
 
-// 16 MAD1 AIDs + 1 MAD2 marker (0x0005) + 23 MAD2 AIDs = 40
-#define MAD_MAX_AID_ENTRIES 40
+// 15 MAD1 AIDs (sectors 1-15) + 1 MAD2 marker (0x0005) + 23 MAD2 AIDs (sectors 17-39) = 39
+#define MAD_MAX_AID_ENTRIES 39
 
 int MADCheck(uint8_t *sector0, uint8_t *sector16, bool verbose, bool *haveMAD2);
 int MADDecode(uint8_t *sector0, uint8_t *sector16, uint16_t *mad, size_t *madlen, bool swapmad, bool override);