[PATCH] smsutil: check that user data length fits in internal buffer
Jean-Marie Lemetayer <[email protected]>
| Newsgroups | dev.linux.lists.ofono |
|---|---|
| Message-ID | <[email protected]> |
This addresses CVE-2023-2794. --- src/smsutil.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/smsutil.c b/src/smsutil.c index 39f0ecc6..7f065d9d 100644 --- a/src/smsutil.c +++ b/src/smsutil.c @@ -773,6 +773,9 @@ static gboolean decode_deliver(const unsigned char *pdu, int len, if ((len - offset) < expected) return FALSE; + if (expected > sizeof(out->deliver.ud)) + return FALSE; + memcpy(out->deliver.ud, pdu + offset, expected); return TRUE; -- 2.34.1