From 2ff2da7ac374a790f8b2a0216bcb4e3126498225 Mon Sep 17 00:00:00 2001 From: "Sicelo A. Mhlongo" Date: Wed, 4 Dec 2024 10:18:52 +0200 Subject: [PATCH] smsutil: check status report fits in buffer Fixes CVE-2023-4232 CVE: CVE-2023-4232 Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=2ff2da7ac374a790f8b2a0216bcb4e3126498225] Signed-off-by: Peter Marko --- src/smsutil.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/smsutil.c b/src/smsutil.c index ac89f16c..a706e26f 100644 --- a/src/smsutil.c +++ b/src/smsutil.c @@ -1088,6 +1088,9 @@ static gboolean decode_status_report(const unsigned char *pdu, int len, if ((len - offset) < expected) return FALSE; + if (expected > (int)sizeof(out->status_report.ud)) + return FALSE; + memcpy(out->status_report.ud, pdu + offset, expected); } -- 2.30.2