There are potential memory leaks in MMLocationGpsNmea:
- When the `trace' string provided to location_gps_nmea_take_trace() isn't
added to the hash table, its ownership is still considered transferred.
It should thus be freed. Similarly, the `trace_type' string isn't
added the hash table and should thus be freed.
- mm_location_gps_nmea_add_trace() duplicates a given trace string and
then passes the trace copy to location_gps_nmea_take_trace(). When
location_gps_nmea_take_trace() returns FALSE, the ownership of the
copy isn't transferred. mm_location_gps_nmea_add_trace() should thus
free the copy.
This patch fixes the above memory leaks by having
location_gps_nmea_take_trace() always take the ownership of the `trace'
string and internally free `trace' and `trace_type' when necessary.
This patch fixes an ineffective `g_assert (equip_id)' in
modem_load_equipment_identifier_finish(). After mm_parse_gsn() succeeds,
`equip_id' is freed but not reset to NULL, so `g_assert (equip_id)' will
never assert even if `imei', `meid', and `esn' are all NULL (though that
shouldn't happen when mm_parse_gsn() succeeds).
This patch fixes some potential use-after-freed issues in
dms_get_ids_ready(). When an invalid ESN / MEID is retrieved,
`ctx->self->priv->esn' / `ctx->self->priv->meid' is freed but not reset
to NULL. If no IMEI is retrieved, `str' can be set to the already freed
`ctx->self->priv->esn' / `ctx->self->priv->meid' and then propagated to
a GSimpleAsyncResult object.
This patch fixes an issue in disconnect_set_ready(). If
mbim_message_connect_response_parse(), `session_id' and `nw_error' are
not set to a valid value, and thus shouldn't be used.
During the CONNECT_3GPP_CONTEXT_STEP_LAST step,
connect_3gpp_context_step() conditionally creates and populates a
MMBearerConnectResult object into the GSimpleAsyncResult object when the
ipv4_config field of the Connect3gppContext struct is set. That assumes
the ipv4_config field is always initialized in
connect_dhcp_check_ready() during the
CONNECT_3GPP_CONTEXT_STEP_IP_CONFIG step. Instead of having such an
assumption, this patch modifies connect_3gpp to always initialize
the ipv4_config field, such that connect_3gpp_context_step() always
populates a MMBearerConnectResult object into the GSimpleAsyncResult
object.
This patch fixes cause_code_to_delivery_state() by adding two missing
break statements for the case ERROR_CLASS_TEMPORARY and
ERROR_CLASS_PERMANENT in the `switch (error_class)` statement. Without
the break statements, the switch always falls through to the default and
returns MM_SMS_DELIVERY_STATE_UNKNOWN for an `error_class' of value
ERROR_CLASS_TEMPORARY or ERROR_CLASS_PERMANENT.
The following checks in mm_modem_firmware_select() and
mm_modem_firmware_select_sync() could result in a NULL pointer
dereference if `unique_id' is NULL:
g_return_if_fail (unique_id != NULL || unique_id[0] == '\0')
g_return_val_if_fail (unique_id != NULL || unique_id[0] == '\0', FALSE)
This patch fixes the checks to properly verify that `unique_id' is
neither NULL nor an empty string.
With some modems, the lock/unlock of the SIM-ME interface with +CSIM=1/0
command is followed by #QSS unsolicited messages. With the current
implementation, this messages are mistaken for SIM swap events and so the
modem is first dropped and then re-probed.
With this patch, the plugin takes into account the SIM-ME lock state when
parsing #QSS unsolicited, so that the QSS handler can correctly
elaborate the messages that are not related to SIM swap events.
Currently, when SIM hot swap fails in either mm-iface or plugin, the
ModemManager still opens ports context and prints a message saying that
SIM hot swap is supported and that it's waiting for SIM insertion,
instead of clearly saying that SIM hot swap is not working.
This patch:
1. introduces a new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
which is FALSE by default and set to TRUE only when
setup_sim_hot_swap_finish() succeded.
2. subordinates the completion of SIM hot swap setup (in
mm-broadband-modem) and the related messages to the the value of
MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED
Finally, this patch replaces the MBIM's sim_hot_swap_on private property
with the new property MM_IFACE_MODEM_SIM_HOT_SWAP_CONFIGURED, since they have the
same meaning.
crm_range_ready() misses a return statement after it invokes
interface_initialization_step(), which will lead to an invalid access of
the already freed InitAsyncContext.
