[PATCH 2/2] smsutil: check status report fits in buffer
"Sicelo A. Mhlongo" <[email protected]>
| Newsgroups | dev.linux.lists.ofono |
|---|---|
| Message-ID | <[email protected]> |
Fixes CVE-2023-4232 --- src/smsutil.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/smsutil.c b/src/smsutil.c index bdb1d04f..8c1aaad3 100644 --- a/src/smsutil.c +++ b/src/smsutil.c @@ -1077,6 +1077,9 @@ static gboolean decode_status_report(const unsigned char *pdu, int len, if ((len - offset) < expected) return FALSE; + if (expected > (int)sizeof(out->status_report.ud)) + return FALSE; + memcpy(out->status_report.ud, pdu + offset, expected); } -- 2.45.2