Open Source Telephony
 help / color / mirror / Atom feed
* [PATCH 1/3] add some length verification to avoid reading not owned memory
@ 2012-02-28  8:17 jr_extern
  2012-02-28  8:17 ` [PATCH 2/3] changing depreciated libtool initialization to modern one jr_extern
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: jr_extern @ 2012-02-28  8:17 UTC (permalink / raw)
  To: ofono

[-- Attachment #1: Type: text/plain, Size: 1200 bytes --]

From: Jens Rehsack <jr_extern@vfnet.de>

---
 src/push.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/src/push.c b/src/push.c
index 6a54907..6107352 100644
--- a/src/push.c
+++ b/src/push.c
@@ -351,13 +351,16 @@ gboolean mms_push_notify(unsigned char *pdu, unsigned int len,
 	/* Consume TID and Type */
 	nread = 2;
 
-	if (wsp_decode_uintvar(pdu + nread, len,
+	if (wsp_decode_uintvar(pdu + nread, len - nread,
 					&headerslen, &consumed) == FALSE)
 		return FALSE;
 
 	/* Consume uintvar bytes */
 	nread += consumed;
 
+	/* Check if content type could be read */
+	if (headerslen > (len - nread))
+		return FALSE;
 	/* Try to decode content-type */
 	if (wsp_decode_content_type(pdu + nread, headerslen, &ct,
 			&consumed, &param_len) == FALSE)
@@ -370,6 +373,9 @@ gboolean mms_push_notify(unsigned char *pdu, unsigned int len,
 	consumed += param_len;
 	nread += consumed;
 
+	/* Check if application_id could be read */
+	if ((headerslen - consumed) > (len - nread))
+		return FALSE;
 	/* Parse header to decode application_id */
 	wsp_header_iter_init(&iter, pdu + nread, headerslen - consumed, 0);
 
-- 
1.7.9.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2012-03-23 19:11 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-28  8:17 [PATCH 1/3] add some length verification to avoid reading not owned memory jr_extern
2012-02-28  8:17 ` [PATCH 2/3] changing depreciated libtool initialization to modern one jr_extern
2012-02-28 16:15   ` Jens Rehsack
2012-03-23 19:09     ` Marcel Holtmann
2012-02-28  8:17 ` [PATCH 3/3] let configure find required libs jr_extern
2012-03-23 19:11   ` Marcel Holtmann
2012-03-23 19:09 ` [PATCH 1/3] add some length verification to avoid reading not owned memory Marcel Holtmann

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox