[PATCH v2] smsutil: check that user data length fits in internal buffer

This addresses CVE-2023-2794.
---
 src/smsutil.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/smsutil.c b/src/smsutil.c
index 39f0ecc6..92d7f3c8 100644
--- a/src/smsutil.c
+++ b/src/smsutil.c
@@ -770,6 +770,9 @@ static gboolean decode_deliver(const unsigned char *pdu, int len,
 
 	expected = sms_udl_in_bytes(out->deliver.udl, out->deliver.dcs);
 
+	if (expected < 0 || expected > (int)sizeof(out->deliver.ud))
+		return FALSE;
+
 	if ((len - offset) < expected)
 		return FALSE;
 
-- 
2.34.1