[PATCH 1/2] smsutil: check deliver reports fit in buffer
"Sicelo A. Mhlongo" <[email protected]>
| Newsgroups | dev.linux.lists.ofono |
|---|---|
| Message-ID | <[email protected]> |
Fixes CVE-2023-4235
---
src/smsutil.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/smsutil.c b/src/smsutil.c
index 8f578c22..bdb1d04f 100644
--- a/src/smsutil.c
+++ b/src/smsutil.c
@@ -1226,10 +1226,16 @@ static gboolean decode_deliver_report(const unsigned char *pdu, int len,
return FALSE;
if (out->type == SMS_TYPE_DELIVER_REPORT_ERROR) {
+ if (expected > (int) sizeof(out->deliver_err_report.ud))
+ return FALSE;
+
out->deliver_err_report.udl = udl;
memcpy(out->deliver_err_report.ud,
pdu + offset, expected);
} else {
+ if (expected > (int) sizeof(out->deliver_ack_report.ud))
+ return FALSE;
+
out->deliver_ack_report.udl = udl;
memcpy(out->deliver_ack_report.ud,
pdu + offset, expected);
--
2.45.2