From 07f48b23e3877ef7d15a7b0b8b79d32ad0a3607e Mon Sep 17 00:00:00 2001
From: Denis Kenzior <denkenz@gmail.com>
Date: Mon, 5 Aug 2024 20:23:38 +0800
Subject: [PATCH] simutil: Make sure set_length on the parent succeeds

CVE: CVE-2023-2794
Upstream-Status: Backport [https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=07f48b23e3877ef7d15a7b0b8b79d32ad0a3607e]

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
 src/simutil.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/simutil.c b/src/simutil.c
index 59d8d5d..0e131e8 100644
--- a/src/simutil.c
+++ b/src/simutil.c
@@ -588,8 +588,9 @@ gboolean ber_tlv_builder_set_length(struct ber_tlv_builder *builder,
	if (new_pos > builder->max)
		return FALSE;

-	if (builder->parent)
-		ber_tlv_builder_set_length(builder->parent, new_pos);
+	if (builder->parent &&
+			!ber_tlv_builder_set_length(builder->parent, new_pos))
+		return FALSE;

	builder->len = new_len;

@@ -730,9 +731,9 @@ gboolean comprehension_tlv_builder_set_length(
	if (builder->pos + new_ctlv_len > builder->max)
		return FALSE;

-	if (builder->parent)
-		ber_tlv_builder_set_length(builder->parent,
-						builder->pos + new_ctlv_len);
+	if (builder->parent && !ber_tlv_builder_set_length(builder->parent,
+						builder->pos + new_ctlv_len))
+		return FALSE;

	len = MIN(builder->len, new_len);
	if (len > 0 && new_len_size != len_size)
--
2.25.1
