buggnokii - Bugs: bug #31222, smsd crashes if an sms full of...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #31222: smsd crashes if an sms full of escapable characters is received

Submitted by:  Angelo <bsod85>
Submitted on:  Sat 02 Oct 2010 10:15:19 AM UTC  
 
Category: smsdSeverity: 3 - Normal
Item Group: crashStatus: Ready For Test
Privacy: PublicAssigned to: Jan Derfinak <ja>
Open/Closed: Closed

(Jump to the original submission Jump to the original submission)

Sat 19 Mar 2011 09:28:09 AM UTC, comment #6:

No response from reporter for month. I closing the bug.

Jan Derfinak <ja>
Project MemberIn charge of this item.
Sun 20 Feb 2011 12:11:20 AM UTC, comment #5:

Hello Angelo.

Attached is a patch with rewrited code for multipart messages.
Please test it and let me know if it works for you.

I thank you for your help.

(file #22738)

Jan Derfinak <ja>
Project MemberIn charge of this item.
Thu 17 Feb 2011 08:15:57 PM UTC, comment #4:

Yes, it crashes only with multipart messages.

Angelo <bsod85>
Thu 17 Feb 2011 10:44:34 AM UTC, comment #3:

Hello Angelo.

I looked at your proposal and I need to clarify that you see problem only when when receiving multipart messages. Is this true?

Bottom line: The original smsd code seems to escape strings correctly, but multipart code doesn't.

Jan Derfinak <ja>
Project MemberIn charge of this item.
Mon 25 Oct 2010 04:34:27 PM UTC, comment #2:

I am using gnokii version 0.6.26

The SMS that caused the crash was filled of apostrophes (')
Something like this:
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

The LANG variable of the user is en_US.UTF-8

Angelo <bsod85>
Mon 25 Oct 2010 03:18:49 PM UTC, comment #1:

Which version crashed?

A bug with multipart SMS was fixed with commit 02ed427907e2dbd6673e4045a2f806cc0b7cd83a
Date: Sat Aug 28 14:32:21 2010 +0200

Can you show the plain text of a message that overflows the buffer and the value of your LANG environment variable of the user that runs smsd?

Daniele Forsi <dforsi>
Project Administrator
Sat 02 Oct 2010 10:15:19 AM UTC, original submission:

There's a buffer overflow in DB_InsertSMS function in file mysql.c.
The text and tmpText vars are allocated respectively GN_SMS_LONG_MAX_LENGHT and GN_SMS_MAX_LENGTH but after the message is escaped it can overflow this sizes.
My suggested correction is to allocate the max length '* 2 + 1' for this two vars.
Sorry but I am not able to make a patch at this time.

Angelo <bsod85>

 

Attached Files
file #22738:  multipart2.diff added by ja (28KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ja (Posted a comment)
  • -unavailable- added by dforsi (Posted a comment)
  • -unavailable- added by bsod85 (Submitted the item)
  • -unavailable- added by bsod85
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 19 Mar 2011 09:28:09 AM UTCjaOpen/ClosedOpen=>Closed
    Sun 20 Feb 2011 12:11:20 AM UTCjaAttached File-=>Added multipart2.diff, #22738
      StatusNeed Info=>Ready For Test
    Thu 17 Feb 2011 10:45:09 AM UTCjaAssigned toNone=>ja
    Mon 25 Oct 2010 03:18:49 PM UTCdforsiStatusNone=>Need Info
    Sat 02 Oct 2010 10:15:19 AM UTCbsod85Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1