Attention is currently required from: fixeria, laforge, n0k0, pespin.
n0k0 uploaded patch set #4 to this change.
The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by pespin, Code-Review+2 by fixeria, Verified-1 by Jenkins Builder
smpp34_unpack: bound C_OCTET scan with strnlen()
The C_OCTET macro runs strlen() on the attacker-controlled wire buffer
before any bounds check. SMPP PDUs are decoded straight out of a buffer
sized exactly to the wire command_length with no trailing NUL, so a
C-Octet-String field that runs to the end of the buffer without a
terminator makes strlen() read past the end of the allocation (out of
bounds heap read), and the post-hoc "lenval > left" check runs only
after the over-read has already happened.
Scan with strnlen(aux, left) so the read can never go past the remaining
buffer; if no terminator is found within 'left' bytes, lenval becomes
left + 1 and the existing length check rejects the PDU.
This issue has been assigned the CVE candidate identifier
CAN-2026-2051038.
Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814
---
M src/smpp34_unpack.c
1 file changed, 1 insertion(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/libsmpp34 refs/changes/89/42889/4
To view, visit change 42889. To unsubscribe, or for help writing mail filters, visit settings.