SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

broadband-modem-mbim: avoid using already freed element during iteration

Browse Source 
If we remove the current element being iterated in the GList, we can
no longer call g_list_next() on it. Ensure we keep a valid pointer to
the next element in the list before removing the current one.
This commit is contained in:
Aleksander Morgado
2023-02-17 10:43:20 +00:00
committed by Aleksander Morgado
parent d1ed6114a8
commit 5c5126b7ff
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mm-broadband-modem-mbim.c
+8 -2
View File
@@ -2608,6 +2608,7 @@ base_stations_info_query_ready (MbimDevice *device,
if (lte_serving_cell) {
GList *l;
GList *next;
info = mm_cell_info_lte_new_from_dictionary (NULL);
mm_cell_info_set_serving (info, TRUE);
@@ -2622,9 +2623,11 @@ base_stations_info_query_ready (MbimDevice *device,
CELL_INFO_SET_UINT (lte_serving_cell->timing_advance, 0xFFFFFFFF, lte_set_timing_advance, MM_CELL_INFO_LTE);
/* Update cell info with the radio frequency information received previously */
for (l = ctx->rfim_info_list; l; l = g_list_next (l)) {
for (l = ctx->rfim_info_list, next = NULL; l; l = next) {
MMRfInfo *data;
next = g_list_next (l);
data = (MMRfInfo *)(l->data);
if (fabs ((mm_get_downlink_carrier_frequency (lte_serving_cell->earfcn, self)) - data->center_frequency) < FREQUENCY_TOLERENCE) {
mm_obj_dbg (self, "Merging radio frequency data with lte serving cell info");
@@ -2678,6 +2681,7 @@ base_stations_info_query_ready (MbimDevice *device,
for (i = 0; i < nr_serving_cells_count; i++) {
GList *l;
GList *next;
info = mm_cell_info_nr5g_new_from_dictionary (NULL);
mm_cell_info_set_serving (info, TRUE);
@@ -2693,9 +2697,11 @@ base_stations_info_query_ready (MbimDevice *device,
CELL_INFO_SET_UINT (nr_serving_cells[i]->timing_advance, 0xFFFFFFFFFFFFFFFF, nr5g_set_timing_advance, MM_CELL_INFO_NR5G);
/* Update cell info with the radio frequency information received previously */
for (l = ctx->rfim_info_list; l; l = g_list_next (l)) {
for (l = ctx->rfim_info_list, next = NULL; l; l = next) {
MMRfInfo *data;
next = g_list_next (l);
data = (MMRfInfo *)(l->data);
/* Comparing the derived frequncy value from NRARFCN with received center frequency data to map the NR CELL */
if (fabs ((mm_get_frequency_from_nrarfcn (nr_serving_cells[i]->nrarfcn, self) * HERTZ_CONV) - data->center_frequency) < FREQUENCY_TOLERENCE) {