laforge has submitted this change. ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... smpp34_unpack: bound C_OCTET scan with strnlen() The C_OCTET macro runs strlen() on the attacker-controlled wire buffer before any bounds check. SMPP PDUs are decoded straight out of a buffer sized exactly to the wire command_length with no trailing NUL, so a C-Octet-String field that runs to the end of the buffer without a terminator makes strlen() read past the end of the allocation (out of bounds heap read), and the post-hoc "lenval > left" check runs only after the over-read has already happened. Scan with strnlen(aux, left) so the read can never go past the remaining buffer; if no terminator is found within 'left' bytes, lenval becomes left + 1 and the existing length check rejects the PDU. This issue has been assigned the CVE candidate identifier CAN-2026-2051038. Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 --- M src/smpp34_unpack.c 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved diff --git a/src/smpp34_unpack.c b/src/smpp34_unpack.c index ec73d35..47d34ba 100644 --- a/src/smpp34_unpack.c +++ b/src/smpp34_unpack.c @@ -127,7 +127,7 @@ #define C_OCTET( inst, par, size ){\ - lenval = strlen( (char*) aux ) + 1;\ + lenval = strnlen((char *)aux, left) + 1;\ if( lenval > left ){\ PUTLOG("[len(%s):%d(%s)]", par, lenval, \ "Value length exceed buffer length");\ -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom@hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy@sysmocom.de> Gerrit-Reviewer: laforge <laforge@osmocom.org> Gerrit-Reviewer: pespin <pespin@sysmocom.de>