Hi Kannel people,

here's a rarely occurring but fatal bug I found from 1.1.6 in a hard
way: SMPP SMSC driver (for example function) does not check lengths of
any fields when setting values to Msg struct _but_ assert in function
smpp_pdu_pack in gw/smpp_pdu.c fails, if null-terminated string fields
are over-lengthed.

You can reproduce this by sending request from Kannel to your
application and returning forced sender number that is more than 20
digits long.

While there shouldn't exist real phone numbers that long, it's enough to
have proper bug in other parts of the system feeding bad data to Kannel
and it dies. I consider this as a bad thing.

-- 
Jari Juslin, Development Team Leader   MatchEm Ltd   
[EMAIL PROTECTED]                http://www.matchem.com/
Mob. +358-44-380 0012                  fax: +358-9-644 091

Reply via email to