From 8d74bc66146ea78620d140640a0a57af86fc8936 Mon Sep 17 00:00:00 2001 From: Denis Grigorev Date: Thu, 21 Dec 2023 17:16:38 +0300 Subject: [PATCH] smsutil: Check that submit report fits in memory This addresses CVE-2023-4234. CVE: CVE-2023-4234. Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=8d74bc66146ea786] Signed-off-by: Archana Polampalli --- src/smsutil.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/smsutil.c b/src/smsutil.c index 8e57a06..5a12708 100644 --- a/src/smsutil.c +++ b/src/smsutil.c @@ -938,10 +938,16 @@ static gboolean decode_submit_report(const unsigned char *pdu, int len, return FALSE; if (out->type == SMS_TYPE_SUBMIT_REPORT_ERROR) { + if (expected > (int) sizeof(out->submit_err_report.ud)) + return FALSE; + out->submit_err_report.udl = udl; memcpy(out->submit_err_report.ud, pdu + offset, expected); } else { + if (expected > (int) sizeof(out->submit_ack_report.ud)) + return FALSE; + out->submit_ack_report.udl = udl; memcpy(out->submit_ack_report.ud, pdu + offset, expected); -- 2.40.0