SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge request !1507 from 'CVE-2026-95622-new'

Browse Source 
CVE-2026-95622: cbm: don't assert handling unsupported encodings (8-bit and reserved)

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1507
This commit is contained in:
Dan Williams
2026-10-04 08:52:00 -05:00
parent faa5642962 ee761d009d
commit b422bd58ef
2 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mm-cbm-part.c
+3 -1
View File
@@ -225,7 +225,9 @@ mm_cbm_part_new_from_binary_pdu (const guint8 *pdu,
cbm_part->encoding = MM_SMS_ENCODING_GSM7;
else if (charset == CBS_DATA_CODING_GENERAL_UCS2)
cbm_part->encoding = MM_SMS_ENCODING_UCS2;
} else {
}
if (cbm_part->encoding == MM_SMS_ENCODING_UNKNOWN) {
g_set_error (error,
MM_CORE_ERROR,
MM_CORE_ERROR_FAILED,
src/tests/test-cbm-part.c
+51
View File
@@ -161,6 +161,54 @@ test_cbm_eu (void)
g_assert_cmpstr (mm_cbm_part_get_language (part), ==, "en");
}
static void
test_cbm_unhandled_data_coding_group_general_charset_reserved (void)
{
g_autoptr(GError) err = NULL;
g_autoptr(MMCbmPart) part = NULL;
static const guint8 pdu [] = {
0x63, 0x40, 0x00, 0x32, 0x5C, 0x14,
0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e,
0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e,
0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d,
0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20,
0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e,
0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56,
0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56,
0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41,
0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40,
0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42,
0x04, 0x3d, 0x16, 0x01, 0x00, 0x00};
part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err);
g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED);
}
static void
test_cbm_unhandled_data_coding_group_general_charset_8bit (void)
{
g_autoptr(GError) err = NULL;
g_autoptr(MMCbmPart) part = NULL;
static const guint8 pdu [] = {
0x63, 0x40, 0x00, 0x32, 0x54, 0x14,
0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e,
0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e,
0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d,
0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20,
0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e,
0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56,
0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56,
0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41,
0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40,
0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42,
0x04, 0x3d, 0x16, 0x01, 0x00, 0x00};
part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err);
g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED);
}
static void
parse_cbm (const char *str, MMCbmPart **part)
{
@@ -328,6 +376,9 @@ int main (int argc, char **argv)
g_test_add_func ("/MM/CBM/PDU-Parser/has-7bit-lang", test_cbm_ucs2_with_7bit_lang);
/* UCS2 message with additional padding: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/253#note_3355339 */
g_test_add_func ("/MM/CBM/PDU-Parser/UCS2/pad", test_cbm_ucs2_pad);
/* Ensure unhandled encodings don't trigger asserts */
g_test_add_func ("/MM/CBM/PDU-Parser/8bit/error", test_cbm_unhandled_data_coding_group_general_charset_8bit);
g_test_add_func ("/MM/CBM/PDU-Parser/reserved/error", test_cbm_unhandled_data_coding_group_general_charset_reserved);
return g_test_run ();
}