git:master:d439a040: sms: more printing to buffer with size limit - sr-dev

21 Nov 2023

Module: kamailio
Branch: master
Commit: d439a0400caee337419cb2645b549d4926ede04e
URL: https://github.com/kamailio/kamailio/commit/d439a0400caee337419cb2645b549d49...
Author: Daniel-Constantin Mierla miconda@gmail.com
Committer: Daniel-Constantin Mierla miconda@gmail.com
Date: 2023-11-21T12:58:17+01:00
sms: more printing to buffer with size limit
---
Modified: src/modules/sms/libsms_getsms.c
Modified: src/modules/sms/libsms_modem.c
Modified: src/modules/sms/sms_funcs.c
---
Diff:  https://github.com/kamailio/kamailio/commit/d439a0400caee337419cb2645b549d49...
Patch: https://github.com/kamailio/kamailio/commit/d439a0400caee337419cb2645b549d49...
---

diff --git a/src/modules/sms/libsms_getsms.c b/src/modules/sms/libsms_getsms.c
index 94f50f917b2..e4ff2296707 100644
--- a/src/modules/sms/libsms_getsms.c
+++ b/src/modules/sms/libsms_getsms.c
@@ -160,7 +160,7 @@ static int fetchsms(struct modem *mdm, int sim, char *pdu)
    	}
    } else {
    	LM_DBG("Trying to get stored message %i\n", sim);
-		clen = sprintf(command, "AT+CMGR=%i\r", sim);
+		clen = snprintf(command, 16, "AT+CMGR=%i\r", sim);
    	put_command(mdm, command, clen, answer, sizeof(answer), 50, 0);
    	/* search for beginning of the answer */
    	position = strstr(answer, "+CMGR:");
@@ -200,7 +200,7 @@ static void deletesms(struct modem *mdm, int sim)
    int clen;
LM_DBG("Deleting message %i !\n", sim);
-	clen = sprintf(command, "AT+CMGD=%i\r", sim);
+	clen = snprintf(command, 32, "AT+CMGD=%i\r", sim);
    put_command(mdm, command, clen, answer, sizeof(answer), 50, 0);
 }
@@ -308,13 +308,13 @@ static int splitascii(struct modem *mdm, char *source, struct incame_sms *sms)
    }
    /* Get the date */
    start = end + 3;
-	sprintf(dbuf, "%c%c-%c%c-%c%c", start[3], start[4], start[0], start[1],
-			start[6], start[7]);
+	snprintf(dbuf, DATE_LEN + 1, "%c%c-%c%c-%c%c", start[3], start[4], start[0],
+			start[1], start[6], start[7]);
    memcpy(sms->date, dbuf, DATE_LEN);
    /* Get the time */
    start += 9;
-	sprintf(tbuf, "%c%c:%c%c:%c%c", start[0], start[1], start[3], start[4],
-			start[7], start[7]);
+	snprintf(tbuf, TIME_LEN + 1, "%c%c:%c%c:%c%c", start[0], start[1], start[3],
+			start[4], start[7], start[7]);
    memcpy(sms->time, tbuf, TIME_LEN);
    sms->userdatalength = strlen(sms->ascii);
    return 1;
diff --git a/src/modules/sms/libsms_modem.c b/src/modules/sms/libsms_modem.c
index 1740b2ab463..7540b99ab33 100644
--- a/src/modules/sms/libsms_modem.c
+++ b/src/modules/sms/libsms_modem.c
@@ -225,7 +225,8 @@ int initmodem(struct modem *mdm, cds_report cds_report_f)
    	put_command(mdm, "AT+CPIN?\r", 9, answer, sizeof(answer), 50, 0);
    	if(strstr(answer, "+CPIN: SIM PIN")) {
    		LM_INFO("Modem needs PIN, entering PIN...\n");
-			clen = sprintf(command, "AT+CPIN="%s"\r", mdm->pin);
+			clen = snprintf(
+					command, MAX_CHAR_BUF + 12, "AT+CPIN="%s"\r", mdm->pin);
    		put_command(mdm, command, clen, answer, sizeof(answer), 100, 0);
    		put_command(mdm, "AT+CPIN?\r", 9, answer, sizeof(answer), 50, 0);
    		if(!strstr(answer, "+CPIN: READY")) {
@@ -377,7 +378,7 @@ int setsmsc(struct modem *mdm, char *smsc)
    int clen;
if(smsc && smsc[0]) {
-		clen = sprintf(command, "AT+CSCA="+%s"\r", smsc);
+		clen = snprintf(command, 100, "AT+CSCA="+%s"\r", smsc);
    	put_command(mdm, command, clen, answer, sizeof(answer), 50, 0);
    }
    return 0;
diff --git a/src/modules/sms/sms_funcs.c b/src/modules/sms/sms_funcs.c
index 7c45d8c5967..f0cf47afa7d 100644
--- a/src/modules/sms/sms_funcs.c
+++ b/src/modules/sms/sms_funcs.c
@@ -487,7 +487,7 @@ int send_as_sms(struct sms_msg *sms_messg, struct modem *mdm)
    		goto error;
    	if(sms_report_type != NO_REPORT)
    		add_sms_into_report_queue(ret_code, sms_messg,
-					p - use_nice * (nr_chunks > 1) * SMS_EDGE_PART_LEN,
+					p - SMS_EDGE_PART_LEN * use_nice * (nr_chunks > 1),
    				len_array[i]);
    }

    