From 3322180d4b452e11545b70abc9b2d5af3d241361 Mon Sep 17 00:00:00 2001 From: Scott Griepentrog Date: Mon, 16 Dec 2013 15:30:18 +0000 Subject: app_sms: BufferOverflow when receiving odd length 16 bit message This patch prevents an infinite loop overwriting memory when a message is received into the unpacksms16() function, where the length of the message is an odd number of bytes. (closes issue ASTERISK-22590) Reported by: Jan Juergens Tested by: Jan Juergens ........ Merged revisions 403856 from http://svn.asterisk.org/svn/asterisk/branches/12 git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@403857 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- apps/app_sms.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'apps') diff --git a/apps/app_sms.c b/apps/app_sms.c index 36e7dd660..f693a209e 100644 --- a/apps/app_sms.c +++ b/apps/app_sms.c @@ -696,7 +696,7 @@ static void unpacksms16(unsigned char *i, unsigned char l, unsigned char *udh, i } while (l--) { int v = *i++; - if (l--) { + if (l && l--) { v = (v << 8) + *i++; } *o++ = v; @@ -714,6 +714,7 @@ static int unpacksms(unsigned char dcs, unsigned char *i, unsigned char *udh, in } else if (is8bit(dcs)) { unpacksms8(i, l, udh, udhl, ud, udl, udhi); } else { + l += l % 2; unpacksms16(i, l, udh, udhl, ud, udl, udhi); } return l + 1; -- cgit v1.2.3