SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,573 Commits 2 Branches 0 Tags
8b77e712989cb62c1ce99d8663942a7b1f070c2c
Commit Graph
9573 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Aleksander Morgado 8b77e71298 Merge request !1466 from 'aleksander/qcdm-vreports' 
QCDM OOB read fixes

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1466
 2026-07-13 11:25:58 +02:00
Aleksander Morgado 96cb590724 libqcdm: fix heap out-of-bounds read in qcdm_log_item_evdo_pilot_sets_v2_new 
Validate the active, candidate, and remaining count fields in
qcdm_log_item_evdo_pilot_sets_v2_new() before parsing the sets.
Ensure the received buffer is large enough to contain the number of
sets claimed by the counts.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1070

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-13 10:59:28 +02:00
Aleksander Morgado e9932bde9d libqcdm: fix heap out-of-bounds read in qcdm_cmd_pilot_sets_result 
Validate the active, candidate, and neighbor count fields in
qcdm_cmd_pilot_sets_result() before parsing the sets.

Ensure that the sum of counts does not exceed the size of the static
sets array in the response structure, and that the calculated size
based on the counts fits within the received buffer len.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1069

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-13 10:59:28 +02:00
Aleksander Morgado 76ca77a897 Merge request !1465 from 'aleksander/vreports2' 
Various use-after-free fixes

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1465
 2026-07-10 15:02:49 +02:00
Aleksander Morgado 9642ed9ab5 ublox: fix UAF in custom init ready URC handler 
Clear the unsolicited message handler in ready_received() before
completing the task. Otherwise, if the modem sends subsequent READY
URCs, the handler would fire again using the freed GTask pointer.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado db72a182c1 port-serial-at: fix crash if URC handler is cleared mid-dispatch 
Update parse_unsolicited() to re-check handler->callback on each
iteration of the match dispatch loop. If a URC handler callback clears
itself during dispatch (e.g. to stop listening), subsequent matches in
the same buffer would attempt to call the NULL pointer, causing a crash.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado c3e7ffaae0 plugins: fix GError double-frees when returning errors from tasks 
Use g_steal_pointer() when passing g_autoptr(GError) to
g_task_return_error() to prevent double-free by the automatic cleanup.

GTask takes ownership of the passed GError. If we use g_autoptr(GError)
locally, it will also call g_error_free() when the function returns,
causing a double-free / heap corruption. Stealing the pointer clears the
local variable and prevents the automatic cleanup.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1073

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 166d6c5bc8 quectel: fix UAF in RDY URC handler 
Defer the validity change (which triggers modem reprobe/removal) to an
idle callback in rdy_handler().

Calling mm_base_modem_set_valid(FALSE) synchronously from the URC
handler triggers the immediate destruction of the modem object while the
serial port is still iterating the unsolicited message handlers. Deferring
the operation to an idle callback and taking a reference to the modem
ensures the modem object is kept alive until parse_unsolicited() has
returned.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 46a91399ca shared-qmi: fix UAF on duplicate list-configs indications 
Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 2b1aaca4a0 ifaces: fix UAFs in signal handlers when hot-unplugging 
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.

Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 0280bbae3b time: fix GSource leak and UAF in timezone poll 
Introduce a timezone poll session ID to validate timezone load
results. This ensures that when a pending timezone load completes, we
discard the result if a new poll session has been started (e.g. due to
registration state changes) or if polling has been stopped.

This prevents leaking GSource timeout sources and a subsequent
Use-After-Free if the modem is hot-unplugged while a poll is pending.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 15:00:07 +02:00
Aleksander Morgado 691bb4286d Merge request !1464 from 'aleksander/vreports' 
Sanitize user inputs

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1464
 2026-07-10 14:35:08 +02:00
Aleksander Morgado 6b3682ed65 voice: validate outgoing and deflect call numbers 
Validate the number parameter in Voice.CreateCall and Call.Deflect
D-Bus methods to ensure they do not contain control characters or
semicolons. This prevents AT command injection when the number is
later spliced into ATD or +CTFR commands.

Introduce a common helper mm_utils_is_valid_dial_number() to validate
dial numbers, and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1067

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 3291e7dd1c sim: validate preferred networks operator codes 
Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).

This change also plugs the network list leak, that was a problem on
its own.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 50202ad76a sim: validate PIN and PUK codes 
Validate PIN and PUK codes in the SIM D-Bus interface handlers to
ensure they are numeric. This prevents injecting AT command
delimiters (like CR) into these fields, which are later spliced
into AT commands (+CPWD, +CLCK, +CPIN).

Introduce a common helper mm_utils_is_numeric() to check if a string
contains only digits, and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado dd54145d71 ussd: quote USSD command to prevent AT injection 
When sending an unencoded USSD command, the user-supplied string was
spliced directly into the +CUSD AT command. If the string contained
CR or semicolons, it could lead to AT command injection.

Use mm_at_quote_string() to properly quote and escape the USSD
command before sending it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1064

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado a39d46c637 location: validate SUPL host as FQDN or IP 
When parsing a SUPL address, if the host is not a valid IPv4 address,
validate it as a FQDN (allowing only alphanumeric characters, dots,
and hyphens). This prevents injecting AT command delimiters (like CR
or semicolon) into the host string, which is later spliced into
modem-specific AT commands (+XLCSSLP).

Introduce a common helper mm_utils_is_valid_fqdn() to validate FQDNs,
and add unit tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1063

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Aleksander Morgado 1ee3a443b1 sms: sanitize decoded alphanumeric SMS addresses 
Alphanumeric SMS addresses decoded from GSM-7 could contain control
characters (like CR/LF), which could lead to AT command injection
if the address is later spliced into an AT+CMGS command during
stored SMS send fallback.

Sanitize the decoded address by removing all control characters.

Introduce a common helper mm_utils_remove_control_characters() to
remove control characters from a string in-place, and add unit
tests for it.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1062

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
 2026-07-10 13:43:48 +02:00
Dan Williams 7088f5eaab Merge request !1457 from 'feat/update-man-mmcli' 
man,mmcli: add information about 'any' modem index  and --location-monitor

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1457
 2026-07-09 16:11:14 -05:00
Andrey Skvortsov 30b76ac3e2 man,mmcli: add description for --location-monitor 
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 23:09:23 -05:00
Andrey Skvortsov 6bdee3cc68 man,mmcli: add information about 'any' modem index for mmcli 
It's possible to use special name 'any' as a modem index. It's
especially useful if system has only single modem.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 23:09:23 -05:00
Dan Williams d776ea38d2 Merge request !1458 from 'feat/use-any-in-man-mmcli' 
man,mmcli: use '-m any' instead of '-m 0' in examples

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1458
 2026-07-08 22:24:34 -05:00
Andrey Skvortsov 913f05e0b4 man,mmcli: use '-m any' instead of '-m 0' in examples 
Most users have only single modem. Commands with '-m any' will work
even if modem gets new index, because it's restarted or is replugged.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-07-08 22:22:18 -05:00
Dan Williams cc69ce8aaf Merge request !1444 from 'main' 
po: add Serbian and Serbian Latin translations

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1444
 2026-07-08 22:11:44 -05:00
Марко М. Костић (Marko M. Kostić) 2c3e8aeee0 po: add Serbian and Serbian Latin translations 
Signed-off-by: Marko Kostic <marko.m.kostic@gmail.com>
 2026-07-08 22:04:01 -05:00
Dan Williams 2b2560c567 Merge request !1462 from 'upd-pt_BR' 
po: update Brazilian Portuguese translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1462
 2026-07-08 22:01:25 -05:00
Rafael Fontenelle 0fbb9d05d2 po: update Brazilian Portuguese translation 
Signed-off-by: Rafael Fontenelle <rafaelff@gnome.org>
 2026-07-08 21:59:02 -05:00
Dan Williams 98777e693f Merge request !1461 from 'dp/fix-me310g1-bnd' 
ME910G1 and ME310M1 bands support and fixes

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1461
 2026-07-07 11:11:51 -05:00
Daniele Palmas 97c24d68e2 telit: add support for ME310M1 
ME310M1 supports band format as ME910G1.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 3ca0cba220 telit: add ME910G1 to models 
ME910G1 supports decimal format for 4G bands and has also an empty
tdscdma slot between 4G and 4G extended bands commands/responses.

Change shared code and helpers to deal with these differences.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 846048caa5 telit: fix band setting function to properly support multi-tech modems 
The assumption that if a modem supports a given access tech, the band
settings for that specific tech should be always given is wrong for
4g, since the 4g bands can be disabled setting the value to 0 in
multi-tech modems like ME310M1.

For example, a 3g + 4g modem could have a setting in which all
the 4g bands are unset and only 3g bands are there: this scenario is
not supported by the current code, but it's legitimate.

Remove this limitation and adapt the code to support bands setting
for multi-tech modems.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas 069212e43e telit: add suffix HEX to 4G extended bands regex macro name 
In preparation to support regex for 4G extended bands decimal values.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Daniele Palmas e292401beb telit: tests: fix LN920 current bands configuration 
Fix LN920 current bands test configuration by setting
modem_has_hex_format_4g_bands to TRUE.

The current wrong setting does not cause the test failure since the modem
supports also extended settings and function telit_get_ext_4g_mm_bands
considers both standard and extended bands as hex without checking
the flag, since decimal format for extended bands is not supported.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
 2026-07-07 10:55:13 -05:00
Dan Williams 545b183934 Merge request !1467 from 'rm520-sahara-firehose' 
quectel: add RM520N Sahara/Firehose support

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1467
 2026-07-07 10:50:42 -05:00
Lukas Voegl 3dbdc0704d quectel: add RM520N Sahara/Firehose support 
Signed-off-by: Lukas Voegl <lvoegl@tdt.de>
 2026-07-03 14:12:48 +02:00
Dan Williams fcc9d19f5e Merge request !1424 from 'fix/multiline-gsv' 
location-gps-nmea: add complete sequence to traces at once

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1424
 2026-05-26 19:16:43 -05:00
Andrey Skvortsov 13a3ee81a3 libmm-glib: add more tests for MMLocationGpsNmea 
Extra tests cover various corner cases.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Dan Williams c0d9497066 libmm-glib: add tests for MMLocationGpsNmea 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-26 20:56:53 +00:00
Andrey Skvortsov f7da97989b location-gps-nmea: add complete sequence to traces at once 
Currently sequence messages are added to traces as they are
received. Therefore content of traces depends at the time, when
request is issued and data is reported. Sometimes not all sequence
traces are reported, because only first record was received yet and it
overwrote previous full sequence trace.

For example,

```
$GPGSV,3,1,12,01,35,282,,02,68,264,,03,02,243,,08,35,206,,1*68
$GPGSV,3,2,12,10,46,074,,14,16,312,,17,,,,22,16,327,,1*53
$GPGSV,3,3,12,23,07,068,,24,15,030,,27,14,181,,32,51,120,,1*60

$GLGSV,2,1,08,82,25,135,,76,11,029,,75,21,334,,69,11,201,,1*7A
```

one GSV sentence is missing and second later full sequence is
reported

```
$GPGSV,3,1,12,01,35,282,,02,68,264,,03,02,243,,08,35,206,,1*68
$GPGSV,3,2,12,10,46,074,,14,16,312,,17,,,,22,16,327,,1*53
$GPGSV,3,3,12,23,07,068,,24,15,030,,27,14,181,,32,51,120,,1*60

$GLGSV,2,1,08,82,25,135,,76,11,029,,75,21,334,,69,11,201,,1*7A
$GLGSV,2,2,08,84,40,306,,83,79,161,,67,56,056,,68,58,177,,1*7D
```

Therefore client software reports different number of visible
satellites.

Usually sequence sentences are reported consequently in NMEA
stream. Let's cache and join sequence sentences until new trace type
is received. In that case full sequence always overrides
previous full sequence.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Andrey Skvortsov 38548fedd3 location-gps-nmea: use g_autofree in location_gps_nmea_take_trace to track ownership 
It allows simplify error handling.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
 2026-05-26 20:56:53 +00:00
Dan Williams 42ca47472a Merge request !1431 from 'add-kk-l10n' 
i18n: Add Kazakh translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1431
 2026-05-25 10:10:36 -05:00
Baurzhan Muftakhidinov 027c8c068c po: add Kazakh translation 
Signed-off-by: Baurzhan Muftakhidinov <baurthefirst@gmail.com>
 2026-05-25 10:09:47 -05:00
Dan Williams 62a967131d Merge request !1427 from 'bulgarian' 
po: add Bulgarian translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1427
 2026-05-24 10:59:27 -05:00
twlvnn 07704018dd po: add Bulgarian translation 
Signed-off-by: twlvnn <kraft_werk@tutanota.com>
 2026-05-24 10:57:44 -05:00
Dan Williams de5058c283 Merge request !1429 from 'l10n-sv' 
po: Update Swedish translation

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1429
 2026-05-24 08:47:15 -05:00
Anders Jonsson fc1b1e9b1e po: Update Swedish translation 
Signed-off-by: Anders Jonsson <anders.jonsson@norsjovallen.se>
 2026-05-24 08:43:49 -05:00
Dan Williams 87c88dc237 Merge request !1421 from 'xmm7360-assert-cleanup' 
intel: XMM7360: convert message parsing g_assert()s to GErrors and split out protocol functions

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1421

Closes #1034
 2026-05-24 08:36:57 -05:00
Dan Williams a94dd40a2a intel: XMM7360: convert remaining asserts to error checks 
Return useful errors rather than asserting on unexpected responses.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams fd98a809af sierra: enable XMM7160-based devices like Comneon HL7588 
Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00
Dan Williams a486776a44 intel: XMM7360: better handle negative ASN integers from modem 
The original code for xmm7360_byte_array_read_asn_int() returned
signed integers both from the function and from the returned
Xmm7360RpcMsgArg, but didn't handle sign extension on the
value returned from the function. That would lead to different
values between the function return and the Xmm7360RpcMsgArg
value, which seems wrong.

Make those two correspond and add checks in various places that
shouldn't ever see negative ints.

Signed-off-by: Dan Williams <dan@ioncontrol.co>
 2026-05-24 08:33:48 -05:00