From 9642ed9ab5c8f60228b5ce96958b775eb1ecd3fc Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Thu, 2 Jul 2026 17:53:47 +0000 Subject: [PATCH] ublox: fix UAF in custom init ready URC handler Clear the unsolicited message handler in ready_received() before completing the task. Otherwise, if the modem sends subsequent READY URCs, the handler would fire again using the freed GTask pointer. https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1074 Signed-off-by: Aleksander Morgado --- src/plugins/ublox/mm-plugin-ublox.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/plugins/ublox/mm-plugin-ublox.c b/src/plugins/ublox/mm-plugin-ublox.c index 7921b02f..66eda597 100644 --- a/src/plugins/ublox/mm-plugin-ublox.c +++ b/src/plugins/ublox/mm-plugin-ublox.c @@ -113,6 +113,9 @@ ready_received (MMPortSerialAt *port, g_source_remove (ctx->timeout_id); ctx->timeout_id = 0; + mm_port_serial_at_add_unsolicited_msg_handler (port, ctx->ready_regex, + NULL, NULL, NULL); + mm_obj_dbg (probe, "received READY: port is AT"); /* Flag as an AT port right away */