Bug in sms

Andrzej Zaborowski andrew.zaborowski at intel.com
Wed Sep 16 05:14:30 PDT 2009


Hi,

2009/9/16 Gu, Yang <yang.gu at intel.com>:
>        Today I tried oFono with my cell phone, but it crashed when starting up.
> The problem happens in function at_cmgl_notify() of file drivers/atmodem/sms.c.
> In my case, strlen(hexpdu) == 338, but the buffer "pdu" has maximum size of
> 164. So after decode_hex_own_buf(), some memory was written unexpectedly.

The attached patch adds length check everywehere decode_hex_own_buf()
is used with a static buffer and also enlarges the buffers to account
for SMSC included in a PDU.

Regards


More information about the ofono mailing list