smsc_at crashes on non-numeric SMS destination
"Andrija Petrovic" <[email protected]>
| Newsgroups | gmane.comp.mobile.kannel.devel |
|---|---|
| Message-ID | <[email protected]> |
smsc_at does not check the digits of the address field in the function at2_format_address_field So, if the recipient's address contains a non-numeric string (e.g. 'Info Service'), and that's quite possible, the octstr assertion crashes the bearerbox during octstr_append_char. Added sanity check on digits before calling the octstr_append_char. cheers, Andrija
smsc_at.c.diff
(application/octet-stream, 988 B)
Index: gateway/gw/smsc/smsc_at.c
===================================================================
RCS file: /home/cvs/gateway/gw/smsc/smsc_at.c,v
retrieving revision 1.29
diff -u -b -B -u -r1.29 smsc_at.c
--- gateway/gw/smsc/smsc_at.c 24 Apr 2006 21:32:01 -0000 1.29
+++ gateway/gw/smsc/smsc_at.c 9 May 2006 12:03:22 -0000
@@ -2649,13 +2649,20 @@
);
/* grab the digits from the MSISDN and encode as swapped semi-octets */
- while (octstr_len(temp)) {
+ while ((out)&&(octstr_len(temp))) {
int digit1, digit2;
/* get the first two digit */
digit1 = octstr_get_char(temp,0) - 48;
- if ((digit2 = octstr_get_char(temp,1) - 48) < 0)
+ digit2 = octstr_get_char(temp,1) - '0';
+ if (digit2 < 0)
digit2 = 0x0F;
+ if((digit1>=0)&&(digit1<16)&&(digit2<16)) {
octstr_append_char(out, (digit2 << 4) | digit1);
+ }
+ else {
+ O_DESTROY(out);
+ out = NULL;
+ }
octstr_delete(temp, 0, 2);
}