cellular-infrastructure
/
osmo-msc
mirror of https://gerrit.osmocom.org/osmo-msc
9
0
Fork 0
Code Issues Releases Wiki Activity

smpp_smsc: fix truncated string copy into bind_r.system_id 

The target buffer in libsmpp is 16 bytes long, and snprintf() may omit the
terminating zero. There seems to be no handling for unterminated strings, so
osmo_strlcpy() is the safer (and presumably more optimal) choice.

Change-Id: I5845666201f945ea9f83da62f2dd4bec52eb74cf
This commit is contained in:
Neels Hofmeyr 2017-12-18 04:08:02 +01:00 committed by Harald Welte
parent 9baedafa24
commit 26c218d0e7
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/libmsc/smpp_smsc.c
View File

@ -509,8 +509,7 @@ static int smpp_handle_bind_tx(struct osmo_esme *esme, struct msgb *msg)
bind_r.command_status = rc;
/* build response */
snprintf((char *)bind_r.system_id, sizeof(bind_r.system_id), "%s",
esme->smsc->system_id);
osmo_strlcpy((char*)bind_r.system_id, esme->smsc->system_id, sizeof(bind_r.system_id));
/* add interface version TLV */
tlv.tag = TLVID_sc_interface_version;