laforge has submitted this change. (
https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email )
Change subject: smpp34_unpack: bound C_OCTET scan with strnlen()
......................................................................
smpp34_unpack: bound C_OCTET scan with strnlen()
The C_OCTET macro runs strlen() on the attacker-controlled wire buffer
before any bounds check. SMPP PDUs are decoded straight out of a buffer
sized exactly to the wire command_length with no trailing NUL, so a
C-Octet-String field that runs to the end of the buffer without a
terminator makes strlen() read past the end of the allocation (out of
bounds heap read), and the post-hoc "lenval > left" check runs only
after the over-read has already happened.
Scan with strnlen(aux, left) so the read can never go past the remaining
buffer; if no terminator is found within 'left' bytes, lenval becomes
left + 1 and the existing length check rejects the PDU.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051038.
Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814
---
M src/smpp34_unpack.c
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
Jenkins Builder: Verified
pespin: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
diff --git a/src/smpp34_unpack.c b/src/smpp34_unpack.c
index ec73d35..47d34ba 100644
--- a/src/smpp34_unpack.c
+++ b/src/smpp34_unpack.c
@@ -127,7 +127,7 @@
#define C_OCTET( inst, par, size ){\
- lenval = strlen( (char*) aux ) + 1;\
+ lenval = strnlen((char *)aux, left) + 1;\
if( lenval > left ){\
PUTLOG("[len(%s):%d(%s)]", par, lenval, \
"Value length exceed buffer length");\
--
To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email
To unsubscribe, or for help writing mail filters, visit
https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libsmpp34
Gerrit-Branch: master
Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814
Gerrit-Change-Number: 42889
Gerrit-PatchSet: 4
Gerrit-Owner: n0k0 <[email protected]>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <[email protected]>
Gerrit-Reviewer: laforge <[email protected]>
Gerrit-Reviewer: pespin <[email protected]>
