This patch fixes some potential use-after-freed issues in
dms_get_ids_ready(). When an invalid ESN / MEID is retrieved,
`ctx->self->priv->esn' / `ctx->self->priv->meid' is freed but not reset
to NULL. If no IMEI is retrieved, `str' can be set to the already freed
`ctx->self->priv->esn' / `ctx->self->priv->meid' and then propagated to
a GSimpleAsyncResult object.
This patch fixes an issue in disconnect_set_ready(). If
mbim_message_connect_response_parse(), `session_id' and `nw_error' are
not set to a valid value, and thus shouldn't be used.
During the CONNECT_3GPP_CONTEXT_STEP_LAST step,
connect_3gpp_context_step() conditionally creates and populates a
MMBearerConnectResult object into the GSimpleAsyncResult object when the
ipv4_config field of the Connect3gppContext struct is set. That assumes
the ipv4_config field is always initialized in
connect_dhcp_check_ready() during the
CONNECT_3GPP_CONTEXT_STEP_IP_CONFIG step. Instead of having such an
assumption, this patch modifies connect_3gpp to always initialize
the ipv4_config field, such that connect_3gpp_context_step() always
populates a MMBearerConnectResult object into the GSimpleAsyncResult
object.
This patch fixes cause_code_to_delivery_state() by adding two missing
break statements for the case ERROR_CLASS_TEMPORARY and
ERROR_CLASS_PERMANENT in the `switch (error_class)` statement. Without
the break statements, the switch always falls through to the default and
returns MM_SMS_DELIVERY_STATE_UNKNOWN for an `error_class' of value
ERROR_CLASS_TEMPORARY or ERROR_CLASS_PERMANENT.
The following checks in mm_modem_firmware_select() and
mm_modem_firmware_select_sync() could result in a NULL pointer
dereference if `unique_id' is NULL:
g_return_if_fail (unique_id != NULL || unique_id[0] == '\0')
g_return_val_if_fail (unique_id != NULL || unique_id[0] == '\0', FALSE)
This patch fixes the checks to properly verify that `unique_id' is
neither NULL nor an empty string.
With some modems, the lock/unlock of the SIM-ME interface with +CSIM=1/0
command is followed by #QSS unsolicited messages. With the current
implementation, this messages are mistaken for SIM swap events and so the
modem is first dropped and then re-probed.
With this patch, the plugin takes into account the SIM-ME lock state when
parsing #QSS unsolicited, so that the QSS handler can correctly
elaborate the messages that are not related to SIM swap events.
Currently, when SIM hot swap fails in either mm-iface or plugin, the
ModemManager still opens ports context and prints a message saying that
SIM hot swap is supported and that it's waiting for SIM insertion,
instead of clearly saying that SIM hot swap is not working.
This patch:
1. introduces a new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
which is FALSE by default and set to TRUE only when
setup_sim_hot_swap_finish() succeded.
2. subordinates the completion of SIM hot swap setup (in
mm-broadband-modem) and the related messages to the the value of
MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
Finally, this patch replaces the MBIM's sim_hot_swap_on private property
with the new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED, since they have the
same meaning.
crm_range_ready() misses a return statement after it invokes
interface_initialization_step(), which will lead to an invalid access of
the already freed InitAsyncContext.
Ben Chan
Aleksander Morgado
Carlo Lobrano
Valentin Blot