[PATCH v2 1/3] util: ensure decode_hex_own_buf is passed a valid buffer

[PATCH v2 1/3] util: ensure decode_hex_own_buf is passed a valid buffer

[Sicelo A. Mhlongo]

---
 src/util.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/util.c b/src/util.c
index 53d55d7e..bfe46ef2 100644
--- a/src/util.c
+++ b/src/util.c
@@ -3181,6 +3181,9 @@ unsigned char *decode_hex_own_buf(const char *in, long len, long *items_written,
 	char c;
 	unsigned char b;
 
+	if (!buf)
+		return NULL;
+
 	if (len < 0)
 		len = strlen(in);
 
-- 
2.45.2

[PATCH v2 2/3] atmodem: sms: ensure buffer is initialized before use

[Sicelo A. Mhlongo]

Fixes: CVE-2024-7540
Fixes: CVE-2024-7541
Fixes: CVE-2024-7542
---
 drivers/atmodem/sms.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/atmodem/sms.c b/drivers/atmodem/sms.c
index d994856b..0668c631 100644
--- a/drivers/atmodem/sms.c
+++ b/drivers/atmodem/sms.c
@@ -399,7 +399,7 @@ static void at_cmt_notify(GAtResult *result, gpointer user_data)
 	struct sms_data *data = ofono_sms_get_data(sms);
 	GAtResultIter iter;
 	const char *hexpdu;
-	unsigned char pdu[176];
+	unsigned char pdu[176] = {0};
 	long pdu_len;
 	int tpdu_len;
 
@@ -466,7 +466,7 @@ static void at_cmgr_notify(GAtResult *result, gpointer user_data)
 	struct sms_data *data = ofono_sms_get_data(sms);
 	GAtResultIter iter;
 	const char *hexpdu;
-	unsigned char pdu[176];
+	unsigned char pdu[176] = {0};
 	long pdu_len;
 	int tpdu_len;
 
@@ -648,7 +648,7 @@ static void at_cmgl_notify(GAtResult *result, gpointer user_data)
 	struct sms_data *data = ofono_sms_get_data(sms);
 	GAtResultIter iter;
 	const char *hexpdu;
-	unsigned char pdu[176];
+	unsigned char pdu[176] = {0};
 	long pdu_len;
 	int tpdu_len;
 	int index;
-- 
2.45.2

[PATCH v2 3/3] ussd: ensure ussd content fits in buffers

[Sicelo A. Mhlongo]

Fixes: CVE-2024-7539
---
 drivers/atmodem/ussd.c      | 5 ++++-
 drivers/huaweimodem/ussd.c  | 5 ++++-
 drivers/speedupmodem/ussd.c | 5 ++++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/atmodem/ussd.c b/drivers/atmodem/ussd.c
index 32a9fe91..59dd2e59 100644
--- a/drivers/atmodem/ussd.c
+++ b/drivers/atmodem/ussd.c
@@ -93,7 +93,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 	const char *content;
 	int dcs;
 	enum sms_charset charset;
-	unsigned char msg[160];
+	unsigned char msg[160] = {0};
 	const unsigned char *msg_ptr = NULL;
 	long msg_len;
 
@@ -113,6 +113,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 	if (!g_at_result_iter_next_number(&iter, &dcs))
 		dcs = 0;
 
+	if (strlen(content) > sizeof(msg) * 2)
+		goto out;
+
 	if (!cbs_dcs_decode(dcs, NULL, NULL, &charset, NULL, NULL, NULL)) {
 		ofono_error("Unsupported USSD data coding scheme (%02x)", dcs);
 		status = 4; /* Not supported */
diff --git a/drivers/huaweimodem/ussd.c b/drivers/huaweimodem/ussd.c
index 5e1c9078..3d165c87 100644
--- a/drivers/huaweimodem/ussd.c
+++ b/drivers/huaweimodem/ussd.c
@@ -38,7 +38,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 	int status;
 	int dcs = 0;
 	const char *content;
-	unsigned char msg[160];
+	unsigned char msg[160] = {0};
 	const unsigned char *msg_ptr = NULL;
 	long msg_len;
 
@@ -55,6 +55,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 
 	g_at_result_iter_next_number(&iter, &dcs);
 
+	if (strlen(content) > sizeof(msg) * 2)
+		goto out;
+
 	msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
 
 out:
diff --git a/drivers/speedupmodem/ussd.c b/drivers/speedupmodem/ussd.c
index aafa4bc9..a5efde0c 100644
--- a/drivers/speedupmodem/ussd.c
+++ b/drivers/speedupmodem/ussd.c
@@ -37,7 +37,7 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 	int status;
 	int dcs = 0;
 	const char *content;
-	unsigned char msg[160];
+	unsigned char msg[160] = {0};
 	const unsigned char *msg_ptr = NULL;
 	long msg_len;
 
@@ -54,6 +54,9 @@ static void cusd_parse(GAtResult *result, struct ofono_ussd *ussd)
 
 	g_at_result_iter_next_number(&iter, &dcs);
 
+	if (strlen(content) > sizeof(msg) * 2)
+		goto out;
+
 	msg_ptr = decode_hex_own_buf(content, -1, &msg_len, 0, msg);
 
 out:
-- 
2.45.2

Re: [PATCH v2 1/3] util: ensure decode_hex_own_buf is passed a valid buffer

[patchwork-bot+ofono]

Hello:

This series was applied to ofono.git (master)
by Denis Kenzior <denkenz@gmail.com>:

On Tue, 17 Dec 2024 11:31:27 +0200 you wrote:
> ---
>  src/util.c | 3 +++
>  1 file changed, 3 insertions(+)

Here is the summary with links:
  - [v2,1/3] util: ensure decode_hex_own_buf is passed a valid buffer
    https://git.kernel.org/pub/scm/network/ofono/ofono.git/?id=1e2a768445ae
  - [v2,2/3] atmodem: sms: ensure buffer is initialized before use
    https://git.kernel.org/pub/scm/network/ofono/ofono.git/?id=29ff6334b492
  - [v2,3/3] ussd: ensure ussd content fits in buffers
    https://git.kernel.org/pub/scm/network/ofono/ofono.git/?id=389e2344f863

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html