diff options
| -rw-r--r-- | src/mm-sms-part-3gpp.c | 17 | ||||
| -rw-r--r-- | src/tests/test-sms-part-3gpp.c | 9 |
2 files changed, 18 insertions, 8 deletions
diff --git a/src/mm-sms-part-3gpp.c b/src/mm-sms-part-3gpp.c index 4244de0cd..5d9d637ac 100644 --- a/src/mm-sms-part-3gpp.c +++ b/src/mm-sms-part-3gpp.c @@ -123,7 +123,7 @@ sms_string_to_bcd_semi_octets (guint8 *buf, gsize buflen, const char *string) /* len is in semi-octets */ static gchar * sms_decode_address (const guint8 *address, - gint len, + gint len_digits, GError **error) { guint8 addrtype, addrplan; @@ -138,23 +138,23 @@ sms_decode_address (const guint8 *address, guint8 *unpacked = NULL; guint32 unpacked_len; - unpacked = mm_charset_gsm_unpack (address, (len * 4) / 7, 0, &unpacked_len); + unpacked = mm_charset_gsm_unpack (address, (len_digits * 4) / 7, 0, &unpacked_len); unpacked_array = g_byte_array_new_take (unpacked, unpacked_len); utf8 = mm_modem_charset_bytearray_to_utf8 (unpacked_array, MM_MODEM_CHARSET_GSM, FALSE, error); } else if (addrtype == SMS_NUMBER_TYPE_INTL && addrplan == SMS_NUMBER_PLAN_TELEPHONE) { /* International telphone number, format as "+1234567890" */ - utf8 = g_malloc (len + 3); /* '+' + digits + possible trailing 0xf + NUL */ + utf8 = g_malloc (len_digits + 3); /* '+' + digits + possible trailing 0xf + NUL */ utf8[0] = '+'; - sms_semi_octets_to_bcd_string (utf8 + 1, address, (len + 1) / 2); + sms_semi_octets_to_bcd_string (utf8 + 1, address, (len_digits + 1) / 2); } else { /* * All non-alphanumeric types and plans are just digits, but * don't apply any special formatting if we don't know the * format. */ - utf8 = g_malloc (len + 2); /* digits + possible trailing 0xf + NUL */ - sms_semi_octets_to_bcd_string (utf8, address, (len + 1) / 2); + utf8 = g_malloc (len_digits + 2); /* digits + possible trailing 0xf + NUL */ + sms_semi_octets_to_bcd_string (utf8, address, (len_digits + 1) / 2); } return utf8; @@ -509,7 +509,8 @@ mm_sms_part_3gpp_new_from_binary_pdu (guint index, mm_sms_part_free (sms_part); return NULL; } - PDU_SIZE_CHECK (offset + tp_addr_size_bytes, "cannot read number"); + /* +1 due to the Type of Address byte */ + PDU_SIZE_CHECK (offset + 1 + tp_addr_size_bytes, "cannot read number"); address = sms_decode_address (&pdu[offset], tp_addr_size_digits, error); if (!address) { g_prefix_error (error, "Couldn't read address: "); @@ -518,7 +519,7 @@ mm_sms_part_3gpp_new_from_binary_pdu (guint index, } mm_sms_part_take_number (sms_part, g_steal_pointer (&address)); mm_obj_dbg (log_object, " number parsed: %s", mm_sms_part_get_number (sms_part)); - offset += (1 + tp_addr_size_bytes); /* +1 due to the Type of Address byte */ + offset += (1 + tp_addr_size_bytes); /* ---------------------------------------------------------------------- */ /* Get timestamps and indexes for TP-PID, TP-DCS and TP-UDL/TP-UD */ diff --git a/src/tests/test-sms-part-3gpp.c b/src/tests/test-sms-part-3gpp.c index d6573b13a..9411ad2e3 100644 --- a/src/tests/test-sms-part-3gpp.c +++ b/src/tests/test-sms-part-3gpp.c @@ -449,6 +449,14 @@ test_pdu_no_address (void) common_test_invalid_pdu (pdu, G_N_ELEMENTS (pdu)); } +static void +test_pdu_wrong_address_size (void) +{ + static const guint8 pdu[] = { 0x00, 0x1C, 0x01, 0x1C }; + + common_test_invalid_pdu (pdu, G_N_ELEMENTS (pdu)); +} + /********************* SMS ADDRESS ENCODER TESTS *********************/ static void @@ -746,6 +754,7 @@ int main (int argc, char **argv) g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-not-stored", test_pdu_not_stored); g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-insufficient-data", test_pdu_insufficient_data); g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-no-address", test_pdu_no_address); + g_test_add_func ("/MM/SMS/3GPP/PDU-Parser/pdu-wrong-address-size", test_pdu_wrong_address_size); g_test_add_func ("/MM/SMS/3GPP/Address-Encoder/smsc-intl", test_address_encode_smsc_intl); g_test_add_func ("/MM/SMS/3GPP/Address-Encoder/smsc-unknown", test_address_encode_smsc_unknown); |