From 86f6084b50bb8c3fe2bbf800fc964ff82135dede Mon Sep 17 00:00:00 2001
From: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date: Thu, 15 Oct 2026 02:35:09 +0200
Subject: [PATCH] Security tokens: reject unsupported paths when resolving
 keyfiles

Token::getTokenKeyfile returned null for a path that is neither a
PKCS#11 nor an EMV token path, and every caller dereferenced the
result. Keyfile application validates the path beforehand, but the
text-mode export does not, so entering an ordinary file path at the
--export-token-keyfile prompt crashed VeraCrypt. Throw
InvalidSecurityTokenKeyfilePath instead, which the user interfaces
already report.
---
 src/Common/Token.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Common/Token.cpp b/src/Common/Token.cpp
index 17fce78b..29022d27 100644
--- a/src/Common/Token.cpp
+++ b/src/Common/Token.cpp
@@ -109,6 +109,10 @@ namespace VeraCrypt
 			}		
 		}
 
+		// Callers use the keyfile directly, so any other path is an error.
+		if (!tokenKeyfile)
+			throw InvalidSecurityTokenKeyfilePath();
+
 		return tokenKeyfile;
 	}
 }
\ No newline at end of file