[v2] smsutil: Validate the length of the address field

Commit Message

Denis Grigorev Dec. 28, 2023, 9:51 a.m. UTC

This addresses CVE-2023-4233.
---
 src/smsutil.c | 4 ++++
 1 file changed, 4 insertions(+)

Patch

diff --git a/src/smsutil.c b/src/smsutil.c
index c25dbdbf..77ab0ff1 100644
--- a/src/smsutil.c
+++ b/src/smsutil.c
@@ -627,6 +627,10 @@  gboolean sms_decode_address_field(const unsigned char *pdu, int len,
 	if (!next_octet(pdu, len, offset, &addr_len))
 		return FALSE;
 
+	/* According to 23.040 9.1.2.5 Address-Length must not exceed 20 */
+	 if (addr_len > 20)
+		return FALSE;
+
 	if (sc && addr_len == 0) {
 		out->address[0] = '\0';
 		return TRUE;