9d61db7f06
Thanks to db_sms_test, it was discovered that storing an SMS with empty TP-User-Data (TP-UDL=1) causes buffer overruns in libdbi and it's SQLite3 driver (libdbdsqlite3): DDB NOTICE test_db_sms_store('Empty TP-UD'): ==7791== Invalid write of size 2 ==7791== at 0x857DC60: dbd_quote_binary (in /usr/lib/x86_64-linux-gnu/dbd/libdbdsqlite3.so) ==7791== by 0x5B2B321: dbi_conn_quote_binary_copy (in /usr/lib/x86_64-linux-gnu/libdbi.so.1.1.0) ==7791== by 0x4073B1: db_sms_store (db.c:701) ==7791== by 0x405BB5: test_db_sms_store (db_sms_test.c:310) ==7791== by 0x405BB5: main (db_sms_test.c:546) ==7791== Address 0x7ed1cf0 is 0 bytes after a block of size 0 alloc'd ==7791== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==7791== by 0x857DC4B: dbd_quote_binary (in /usr/lib/x86_64-linux-gnu/dbd/libdbdsqlite3.so) ==7791== by 0x5B2B321: dbi_conn_quote_binary_copy (in /usr/lib/x86_64-linux-gnu/libdbi.so.1.1.0) ==7791== by 0x4073B1: db_sms_store (db.c:701) ==7791== by 0x405BB5: test_db_sms_store (db_sms_test.c:310) ==7791== by 0x405BB5: main (db_sms_test.c:546) ... DDB NOTICE test_db_sms_get('Empty TP-UD'): ==8051== Invalid read of size 1 ==8051== at 0x5B30510: _dbd_decode_binary (in /usr/lib/x86_64-linux-gnu/libdbi.so.1.1.0) ==8051== by 0x857D957: dbd_fetch_row (in /usr/lib/x86_64-linux-gnu/dbd/libdbdsqlite3.so) ==8051== by 0x5B2C86E: dbi_result_seek_row (in /usr/lib/x86_64-linux-gnu/libdbi.so.1.1.0) ==8051== by 0x40828F: next_row (db.c:188) ==8051== by 0x40828F: db_sms_get (db.c:805) ==8051== by 0x406C29: test_db_sms_get (db_sms_test.c:390) ==8051== by 0x405C14: main (db_sms_test.c:547) ==8051== Address 0x8f74641 is 0 bytes after a block of size 1 alloc'd ==8051== at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==8051== by 0x5DBEB49: strdup (strdup.c:42) ==8051== by 0x857D93C: dbd_fetch_row (in /usr/lib/x86_64-linux-gnu/dbd/libdbdsqlite3.so) ==8051== by 0x5B2C86E: dbi_result_seek_row (in /usr/lib/x86_64-linux-gnu/libdbi.so.1.1.0) ==8051== by 0x40828F: next_row (db.c:188) ==8051== by 0x40828F: db_sms_get (db.c:805) ==8051== by 0x406C29: test_db_sms_get (db_sms_test.c:390) ==8051== by 0x405C14: main (db_sms_test.c:547) ==8051== success, as expected DDB NOTICE verify_sms('Empty TP-UD'): user_data_len mismatch: E0 vs A3 Apparently, dbi_conn_quote_binary_copy() doesn't properly handle zero-length input. Let's guard against this. Observed with: - libdbi-dev 0.9.0-1 - libdbd-sqlite3:amd64 0.9.0-2ubuntu2 Change-Id: If0b2bb557118c5f0e520a2e6c2816336f6028661 |
||
---|---|---|
.. | ||
Makefile.am | ||
db_sms_test.c | ||
db_sms_test.err | ||
db_sms_test.ok |