colin/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sms-part-3gpp: avoid underflow in tp_user_data_size_elements

Browse Source 
==101461== Command: ./build/test/mmsmspdu --pdu=004100010100014B00002E --verbose
  ==101461==
  [debug] parsing PDU (0)...
  [debug]   no SMSC address given
  [debug]   submit type PDU detected
  [debug]   message reference: 0
  [debug]   address size: 1 digits (1 bytes)
  [debug]   number parsed: 00
  [debug]   PID: 1
  [debug]   user data encoding is GSM7
  [debug]   user data length: 0 elements
  [debug]   user data length: 0 bytes
  [debug] decoding SMS text with 4294967294 elements

Based on a patch from Michal Mazur <mkm@semihalf.com>.
This commit is contained in:
Aleksander Morgado
2023-03-30 20:08:18 +00:00
parent 60ef408cd7
commit dbafff23a4
2 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/mm-sms-part-3gpp.c
View File

@@ -692,6 +692,7 @@ mm_sms_part_3gpp_new_from_binary_pdu (guint index,
bit_offset = 0;
if (has_udh) {
guint udhl_elements;
guint udhl, end;
udhl = pdu[tp_user_data_offset] + 1;
@@ -753,9 +754,18 @@ mm_sms_part_3gpp_new_from_binary_pdu (guint index,
* user data to get a multiple of 7 (the padding).
*/
bit_offset = (7 - udhl % 7) % 7;
tp_user_data_size_elements -= (udhl * 8 + bit_offset) / 7;
udhl_elements = (udhl * 8 + bit_offset) / 7;
} else
tp_user_data_size_elements -= udhl;
udhl_elements = udhl;
if (udhl_elements >= tp_user_data_size_elements) {
g_set_error (error, MM_CORE_ERROR, MM_CORE_ERROR_FAILED,
"udhl length (%u) is greater than data size (%u)",
udhl_elements, tp_user_data_size_elements);
mm_sms_part_free (sms_part);
return NULL;
}
tp_user_data_size_elements -= udhl_elements;
}
switch (user_data_encoding) {

11
src/tests/test-sms-part-3gpp.c
View File

@@ -457,6 +457,16 @@ test_pdu_wrong_address_size (void)
common_test_invalid_pdu (pdu, G_N_ELEMENTS (pdu));
}
static void
test_pdu_wrong_user_data_elements_size (void)
{
static const guint8 pdu[] = {
0x00, 0x41, 0x00, 0x01, 0x01, 0x00, 0x01, 0x4B,
0x00, 0x00, 0x2E };
common_test_invalid_pdu (pdu, G_N_ELEMENTS (pdu));
}
/********************* SMS ADDRESS ENCODER TESTS *********************/
static void
@@ -755,6 +765,7 @@ int main (int argc, char **argv)
g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-insufficient-data", test_pdu_insufficient_data);
g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-no-address", test_pdu_no_address);
g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-wrong-address-size", test_pdu_wrong_address_size);
g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-wrong-user-data-elements-size", test_pdu_wrong_user_data_elements_size);
g_test_add_func ("/MM/SMS/3GPP/Address-Encoder/smsc-intl", test_address_encode_smsc_intl);
g_test_add_func ("/MM/SMS/3GPP/Address-Encoder/smsc-unknown", test_address_encode_smsc_unknown);