broadband-modem-mbim: initialize autofreed string to NULL
device_caps_query_ready() declares caps_custom_data_class_str as
g_autofree without an initializer. On every early error return
(command failure such as a transaction timeout or NotOpened, or a
response parse failure) the variable is never assigned, so the
autofree cleanup runs g_free() on uninitialized stack garbage,
crashing ModemManager with a glibc "invalid free" abort (or SIGSEGV)
whenever the device caps query fails during modem initialization.
Fixes: 19c817cfe9 ("broadband-modem-mbim: consistently handle custom data classes")
Closes: #1094
Signed-off-by: Semyon Maryasin <simeon@maryasin.name>
This commit is contained in:
committed by
Dan Williams
parent
53a9ad1aa2
commit
6a14658a42
@@ -519,7 +519,7 @@ device_caps_query_ready (MbimDevice *device,
|
||||
GError *error = NULL;
|
||||
LoadCurrentCapabilitiesContext *ctx;
|
||||
MbimDataClass caps_data_class = MBIM_DATA_CLASS_NONE;
|
||||
g_autofree gchar *caps_custom_data_class_str;
|
||||
g_autofree gchar *caps_custom_data_class_str = NULL;
|
||||
|
||||
self = g_task_get_source_object (task);
|
||||
ctx = g_task_get_task_data (task);
|
||||
|
||||
Reference in New Issue
Block a user