get_device_ids() in mm-kernel-device-udev.c accepts a NULL 'vendor' or
'product' argument, but the current implementation could result in a
potential NULL dereferences of the 'vendor' argument. Given that
get_device_ids() is a local helper and its only caller provides a
non-NULL 'vendor' and 'product' argument, this patch removes the NULL
checks (i.e. get_device_ids() expects non-NULL 'vendor' and 'product').
This patch also rearranges the code such that the 'vendor' argument is
updated only when the function returns TRUE, just like how the 'product'
argument is handled.
The while loop in mm_charset_get_encoded_len() iterates through each
valid UTF-8 encoded character in the given NULL-terminated UTF-8 string.
It uses g_utf8_find_next_char() to find the position of the next
character. In case, g_utf8_find_next_char() returns NULL, it tries to
find the end (i.e. the NULL character) of the string.
This patch fixes the following issues in the while loop:
1. The loop uses both 'next' and 'end' to track the position of the next
character in the string.
When g_utf8_find_next_char() returns a non-NULL value, 'next' is
essentially the same as 'end'.
When g_utf8_find_next_char() returns NULL, 'next' remains NULL while
'end' is adjusted to track the end of the string (but is done
incorrectly as described in #2). After the 'p = next' assignment, the
'while (*p)' check results in a NULL dereference. 'p' should thus be
set to 'end' instead of 'next'.
'next' is thus redundant and can be removed.
2. When g_utf8_find_next_char() returns NULL and 'end' is adjusted to
track the end of string, the 'while (*end++)' loop stops when finding
the NULL character, but 'end' is advanced past the NULL character.
After the 'p = end' assignment, the 'while (*p)' check results in a
dereference of out-of-bounds pointer.
'while (*++end)' should be used instead given that 'p' doesn't point
to a NULL character when 'end = p' happens. 'end' will be updated to
point to the NULL character. After the 'p = end' assignment (fixed in
#1), the 'while (*p)' check will properly stop the loop.
This patch fixes a bug in apply_post_probing_filters() where it iterates
through `self->priv->forbidden_product_strings' but incorrectly accesses
`self->priv->product_strings[i]' inside the loop.
`self->priv->forbidden_product_strings[i]' should be accessed instead.
The init-sequence configured for the TTY that is being used as data
port must not be launched during the port reopen() sequence; instead
we must run it manually after the port flashing has finished.
This patch initializes `match_info' in registration_status_check_ready()
to NULL by default, such that `match_info' is always initialized even if
`self->priv->modem_3gpp_registration_regex' contains no elements.
Though `self->priv->modem_3gpp_registration_regex' always contains some
elements in the current implementation, it's better not to rely on that.
This patch fixes an ineffective `g_assert (equip_id)' in
modem_load_equipment_identifier_finish(). After mm_parse_gsn() succeeds,
`equip_id' is freed but not reset to NULL, so `g_assert (equip_id)' will
never assert even if `imei', `meid', and `esn' are all NULL (though that
shouldn't happen when mm_parse_gsn() succeeds).
This patch fixes some potential use-after-freed issues in
dms_get_ids_ready(). When an invalid ESN / MEID is retrieved,
`ctx->self->priv->esn' / `ctx->self->priv->meid' is freed but not reset
to NULL. If no IMEI is retrieved, `str' can be set to the already freed
`ctx->self->priv->esn' / `ctx->self->priv->meid' and then propagated to
a GSimpleAsyncResult object.
This patch fixes an issue in disconnect_set_ready(). If
mbim_message_connect_response_parse(), `session_id' and `nw_error' are
not set to a valid value, and thus shouldn't be used.
This patch fixes cause_code_to_delivery_state() by adding two missing
break statements for the case ERROR_CLASS_TEMPORARY and
ERROR_CLASS_PERMANENT in the `switch (error_class)` statement. Without
the break statements, the switch always falls through to the default and
returns MM_SMS_DELIVERY_STATE_UNKNOWN for an `error_class' of value
ERROR_CLASS_TEMPORARY or ERROR_CLASS_PERMANENT.
Currently, when SIM hot swap fails in either mm-iface or plugin, the
ModemManager still opens ports context and prints a message saying that
SIM hot swap is supported and that it's waiting for SIM insertion,
instead of clearly saying that SIM hot swap is not working.
This patch:
1. introduces a new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
which is FALSE by default and set to TRUE only when
setup_sim_hot_swap_finish() succeded.
2. subordinates the completion of SIM hot swap setup (in
mm-broadband-modem) and the related messages to the the value of
MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
Finally, this patch replaces the MBIM's sim_hot_swap_on private property
with the new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED, since they have the
same meaning.
crm_range_ready() misses a return statement after it invokes
interface_initialization_step(), which will lead to an invalid access of
the already freed InitAsyncContext.
==28664== 4 bytes in 1 blocks are definitely lost in loss record 33 of 4,317
==28664== at 0x4C2BE1F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x4C2E164: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E0CF: g_realloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C06: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C61: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4E8514A: mm_common_build_sms_storages_string (mm-common-helpers.c:116)
==28664== by 0x489035: cpms_query_ready (mm-broadband-modem.c:5428)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x44EADF: at_command_ready (mm-base-modem-at.c:503)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x4D8122: serial_command_ready (mm-port-serial-at.c:392)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664==
==28664== 4 bytes in 1 blocks are definitely lost in loss record 34 of 4,317
==28664== at 0x4C2BE1F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x4C2E164: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E0CF: g_realloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C06: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C61: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4E8514A: mm_common_build_sms_storages_string (mm-common-helpers.c:116)
==28664== by 0x489067: cpms_query_ready (mm-broadband-modem.c:5430)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x44EADF: at_command_ready (mm-base-modem-at.c:503)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== by 0x4D8122: serial_command_ready (mm-port-serial-at.c:392)
==28664== by 0x5E8E335: g_simple_async_result_complete (in /usr/lib/libgio-2.0.so.0.5200.2)
==28664== 216 (120 direct, 96 indirect) bytes in 5 blocks are definitely lost in loss record 4,109 of 4,317
==28664== at 0x4C2BEEF: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==28664== by 0x644E018: g_malloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6465B05: g_slice_alloc (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6469C32: g_string_sized_new (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x4D7861: parse_response (mm-port-serial-at.c:142)
==28664== by 0x4D3B52: parse_response_buffer (mm-port-serial.c:857)
==28664== by 0x4D40F2: common_input_available (mm-port-serial.c:981)
==28664== by 0x4D41B4: iochannel_input_available (mm-port-serial.c:1004)
==28664== by 0x64488B4: g_main_context_dispatch (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6448C77: ??? (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x6448F91: g_main_loop_run (in /usr/lib/libglib-2.0.so.0.5200.2)
==28664== by 0x438035: main (main.c:180)
Aleksander Morgado
Ben Chan
Carlo Lobrano