From: Scott Griepentrog <sgriepentrog@digium.com>
Date: Mon, 16 Dec 2013 15:38:11 +0000 (+0000)
Subject: app_sms: BufferOverflow when receiving odd length 16 bit message
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8befb655f370639d71d9b6d52e66ea6bea79a1fe;p=thirdparty%2Fasterisk.git

app_sms: BufferOverflow when receiving odd length 16 bit message

This patch prevents an infinite loop overwriting memory when
a message is received into the unpacksms16() function, where
the length of the message is an odd number of bytes.

(closes issue ASTERISK-22590)
Reported by: Jan Juergens
Tested by: Jan Juergens


git-svn-id: https://origsvn.digium.com/svn/asterisk/certified/branches/11.2@403859 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/apps/app_sms.c b/apps/app_sms.c
index f4b9ff3c90..da601629ae 100644
--- a/apps/app_sms.c
+++ b/apps/app_sms.c
@@ -697,7 +697,7 @@ static void unpacksms16(unsigned char *i, unsigned char l, unsigned char *udh, i
 	}
 	while (l--) {
 		int v = *i++;
-		if (l--) {
+		if (l && l--) {
 			v = (v << 8) + *i++;
 		}
 		*o++ = v;
@@ -715,6 +715,7 @@ static int unpacksms(unsigned char dcs, unsigned char *i, unsigned char *udh, in
 	} else if (is8bit(dcs)) {
 		unpacksms8(i, l, udh, udhl, ud, udl, udhi);
 	} else {
+		l += l % 2;
 		unpacksms16(i, l, udh, udhl, ud, udl, udhi);
 	}
 	return l + 1;