From 3291e7dd1c444065fb1bf9b6393c3451cd7d5370 Mon Sep 17 00:00:00 2001
From: Aleksander Morgado <aleksandermj@google.com>
Date: Mon, 29 Jun 2026 17:21:11 +0000
Subject: [PATCH] sim: validate preferred networks operator codes

Validate preferred network operator codes in the SIM D-Bus interface
handler to ensure they are numeric. This prevents injecting AT
command delimiters (like CR) into this field, which is later spliced
into AT commands (+CPOL).

This change also plugs the network list leak, that was a problem on
its own.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1065

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
---
 src/mm-base-sim.c | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/mm-base-sim.c b/src/mm-base-sim.c
index 6740c585..efedba02 100644
--- a/src/mm-base-sim.c
+++ b/src/mm-base-sim.c
@@ -1546,12 +1546,34 @@ handle_set_preferred_networks_ready (MMBaseSim *self,
     handle_set_preferred_networks_context_free (ctx);
 }
 
+static gboolean
+validate_networks_list (GList   *networks_list,
+                        GError **error)
+{
+    GList *l;
+
+    for (l = networks_list; l; l = g_list_next (l)) {
+        MMSimPreferredNetwork *network = (MMSimPreferredNetwork *)l->data;
+        const gchar *operator_code;
+
+        operator_code = mm_sim_preferred_network_get_operator_code (network);
+        if (!mm_utils_is_numeric (operator_code)) {
+            g_set_error (error, MM_CORE_ERROR, MM_CORE_ERROR_INVALID_ARGS,
+                         "Invalid operator code: '%s'", operator_code);
+            return FALSE;
+        }
+    }
+
+    return TRUE;
+}
+
 static void
 handle_set_preferred_networks_auth_ready (MMAuthProvider *authp,
                                           GAsyncResult *res,
                                           HandleSetPreferredNetworksContext *ctx)
 {
     GError *error = NULL;
+    GList  *networks_list = NULL;
 
     if (!mm_auth_provider_authorize_finish (authp, res, &error)) {
         mm_dbus_method_invocation_take_error (ctx->invocation, error);
@@ -1581,12 +1603,22 @@ handle_set_preferred_networks_auth_ready (MMAuthProvider *authp,
         return;
     }
 
+    networks_list = mm_sim_preferred_network_list_new_from_variant (ctx->networks);
+    if (!validate_networks_list (networks_list, &error)) {
+        g_list_free_full (networks_list, g_object_unref);
+        mm_dbus_method_invocation_take_error (ctx->invocation, error);
+        handle_set_preferred_networks_context_free (ctx);
+        return;
+    }
+
     mm_obj_info (ctx->self, "processing user request to set preferred networks...");
     MM_BASE_SIM_GET_CLASS (ctx->self)->set_preferred_networks (
             ctx->self,
-            mm_sim_preferred_network_list_new_from_variant (ctx->networks),
+            networks_list,
             (GAsyncReadyCallback)handle_set_preferred_networks_ready,
             ctx);
+
+    g_list_free_full (networks_list, g_object_unref);
 }
 
 static gboolean