n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email )

Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ......................................................................

smpp34_unpack: bound C_OCTET scan with strnlen()

The C_OCTET macro runs strlen() on the attacker-controlled wire buffer before any bounds check. SMPP PDUs are decoded straight out of a buffer sized exactly to the wire command_length with no trailing NUL, so a C-Octet-String field that runs to the end of the buffer without a terminator makes strlen() read past the end of the allocation (out of bounds heap read), and the post-hoc "lenval > left" check runs only after the over-read has already happened.

Scan with strnlen(aux, left) so the read can never go past the remaining buffer; if no terminator is found within 'left' bytes, lenval becomes left + 1 and the existing length check rejects the PDU.

This issue has been assigned the CVE candidate identifier CAN-2026-2051038.

Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 --- M src/smpp34_unpack.c 1 file changed, 1 insertion(+), 1 deletion(-)

git pull ssh://gerrit.osmocom.org:29418/libsmpp34 refs/changes/89/42889/3