|
@@ -1,88 +0,0 @@
|
|
|
-From 389e2344f86319265fb72ae590b470716e038fdc Mon Sep 17 00:00:00 2001
|
|
|
-From: Sicelo A. Mhlongo <absicsz@gmail.com>
|
|
|
-Date: Tue, 17 Dec 2024 11:31:29 +0200
|
|
|
-Subject: [PATCH] ussd: ensure ussd content fits in buffers
|
|
|
-
|
|
|
-Fixes: CVE-2024-7539
|
|
|
-
|
|
|
-CVE: CVE-2024-7539
|
|
|
-Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc]
|
|
|
-
|
|
|
-Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
|
|
|
----
|
|
|
- drivers/atmodem/ussd.c | 5 ++++-
|
|
|
- drivers/huaweimodem/ussd.c | 5 ++++-
|
|
|
- drivers/speedupmodem/ussd.c | 5 ++++-
|
|
|
- 3 files changed, 12 insertions(+), 3 deletions(-)
|
|
|
-
|
|
|
-diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c
|
|
|
-index 32a9fe9..99da559 100644
|
|
|
---- a/drivers/atmodem/ussd.c
|
|
|
-+++ b/drivers/atmodem/ussd.c
|
|
|
-@@ -93,7 +93,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
- const char *content;
|
|
|
- int dcs;
|
|
|
- enum sms_charset charset;
|
|
|
-- unsigned char msg[160];
|
|
|
-+ unsigned char msg[160] = {0};
|
|
|
- const unsigned char *msg_ptr = NULL;
|
|
|
- long msg_len;
|
|
|
-
|
|
|
-@@ -113,6 +113,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
- if (!g_at_result_iter_next_number(&iter, &dcs))
|
|
|
- dcs = 0;
|
|
|
-
|
|
|
-+ if (strlen(content) > sizeof(msg) * 2)
|
|
|
-+ goto out;
|
|
|
-+
|
|
|
- if (!cbs_dcs_decode(dcs, NULL, NULL, &charset, NULL, NULL, NULL)) {
|
|
|
- ofono_error("Unsupported USSD data coding scheme (%02x)", dcs);
|
|
|
- status = 4; /* Not supported */
|
|
|
-diff --git a/drivers/huaweimodem/ussd.c b/drivers/huaweimodem/ussd.c
|
|
|
-index 5e1c907..3d165c8 100644
|
|
|
---- a/drivers/huaweimodem/ussd.c
|
|
|
-+++ b/drivers/huaweimodem/ussd.c
|
|
|
-@@ -38,7 +38,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
- int status;
|
|
|
- int dcs = 0;
|
|
|
- const char *content;
|
|
|
-- unsigned char msg[160];
|
|
|
-+ unsigned char msg[160] = {0};
|
|
|
- const unsigned char *msg_ptr = NULL;
|
|
|
- long msg_len;
|
|
|
-
|
|
|
-@@ -55,6 +55,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
-
|
|
|
- g_at_result_iter_next_number(&iter, &dcs);
|
|
|
-
|
|
|
-+ if (strlen(content) > sizeof(msg) * 2)
|
|
|
-+ goto out;
|
|
|
-+
|
|
|
- msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
|
|
-
|
|
|
- out:
|
|
|
-diff --git a/drivers/speedupmodem/ussd.c b/drivers/speedupmodem/ussd.c
|
|
|
-index aafa4bc..a5efde0 100644
|
|
|
---- a/drivers/speedupmodem/ussd.c
|
|
|
-+++ b/drivers/speedupmodem/ussd.c
|
|
|
-@@ -37,7 +37,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
- int status;
|
|
|
- int dcs = 0;
|
|
|
- const char *content;
|
|
|
-- unsigned char msg[160];
|
|
|
-+ unsigned char msg[160] = {0};
|
|
|
- const unsigned char *msg_ptr = NULL;
|
|
|
- long msg_len;
|
|
|
-
|
|
|
-@@ -54,6 +54,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
|
|
|
-
|
|
|
- g_at_result_iter_next_number(&iter, &dcs);
|
|
|
-
|
|
|
-+ if (strlen(content) > sizeof(msg) * 2)
|
|
|
-+ goto out;
|
|
|
-+
|
|
|
- msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
|
|
|
-
|
|
|
- out:
|
|
|
---
|
|
|
-2.40.0
|